osctrl-api.yaml

openapi: 3.0.0
info:
  contact:
    name: osctrl
    url: https://github.com/jmpsec/osctrl
  description: API service for osctrl, a fast and efficient osquery management solution.
  license:
    name: MIT
    url: https://github.com/jmpsec/osctrl/blob/master/LICENSE
  termsOfService: https://github.com/jmpsec/osctrl
  title: osctrl API
  version: 0.5.9
paths:
  /:
    get:
      description: Returns the API root liveness response.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API root liveness check
      tags:
        - system
  /api/v1/alerts/apply:
    post:
      description: Queues a reload-alerts service command for osctrl-tls. The TLS
        process reloads its alert rule snapshot and resets the channel sender
        cache without restarting. The snapshot swap is atomic; in-flight matches
        finish against the old ruleset.
      responses:
        "202":
          description: Reload requested
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigApplyResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled or service commands unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply alert changes (hot reload)
      tags:
        - alerts
  /api/v1/alerts/channels:
    get:
      description: Returns alert channel rows. Secrets are redacted unless reveal=1 is
        passed by an admin.
      parameters:
        - description: Environment ID; omit to list all
          in: query
          name: env
          schema:
            type: integer
        - description: Pass 1 to include secret fields (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.alertChannelDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List alert channels
      tags:
        - alerts
    post:
      description: Creates a new notification channel. Config is validated against the
        channel type registry.
      requestBody:
        $ref: "#/components/requestBodies/types.AlertChannelCreateRequest"
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create an alert channel
      tags:
        - alerts
  "/api/v1/alerts/channels/{id}":
    delete:
      description: Deletes an alert channel by ID. Rules referencing it keep the
        dangling ID and the dispatcher skips it; deletion takes effect on the
        next alert reload.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an alert channel
      tags:
        - alerts
    get:
      description: Returns a single alert channel by ID. Secrets are redacted unless
        reveal=1.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Pass 1 to include secret fields (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one alert channel
      tags:
        - alerts
    put:
      description: Replaces an existing channel's mutable fields. A secret field set
        to "***" is merged from the previously stored value.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        $ref: "#/components/requestBodies/types.AlertChannelCreateRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update an alert channel
      tags:
        - alerts
  /api/v1/alerts/channels/test:
    post:
      description: Delivers a test notification through the posted channel config.
        Secrets left as "***" are merged from the stored channel named by id.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.AlertChannelTestRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "502":
          description: Delivery failed
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Test an alert channel
      tags:
        - alerts
  /api/v1/alerts/channels/types:
    get:
      description: "Returns the channel type registry: type, description, whether the
        config carries secrets, and which JSON keys hold them."
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.AlertChannelTypeSpec"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List supported alert channel types
      tags:
        - alerts
  /api/v1/alerts/history:
    get:
      description: Returns the most recent dispatched alerts, newest first, capped at 500.
      parameters:
        - description: Maximum rows (default 100, max 500)
          in: query
          name: limit
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/alerts.AlertHistory"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Recent alert history
      tags:
        - alerts
  /api/v1/alerts/rules:
    get:
      description: Returns alert rule rows, optionally filtered by environment.
      parameters:
        - description: Environment ID; omit to list all
          in: query
          name: env
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.alertRuleDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List alert rules
      tags:
        - alerts
    post:
      description: Creates a new alert rule for the given environment (or global when
        environment_id is 0).
      requestBody:
        $ref: "#/components/requestBodies/types.AlertRuleCreateRequest"
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create an alert rule
      tags:
        - alerts
  "/api/v1/alerts/rules/{id}":
    delete:
      description: Deletes an alert rule by ID. Deletion takes effect on the next
        alert reload.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an alert rule
      tags:
        - alerts
    get:
      description: Returns a single alert rule by ID.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one alert rule
      tags:
        - alerts
    put:
      description: Replaces an existing alert rule's mutable fields.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        $ref: "#/components/requestBodies/types.AlertRuleCreateRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update an alert rule
      tags:
        - alerts
  "/api/v1/all-queries/{env}":
    get:
      description: Returns on-demand queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List queries
      tags:
        - queries
  /api/v1/audit-logs:
    get:
      description: Returns paginated API audit log entries.
      parameters:
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Service filter
          in: query
          name: service
          schema:
            type: string
        - description: Username filter
          in: query
          name: username
          schema:
            type: string
        - description: Environment filter
          in: query
          name: env
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.AuditLogsPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List audit logs
      tags:
        - audit
  /api/v1/auth-providers/fetch-metadata:
    post:
      description: Fetches the SAML IdP metadata document from the given URL and
        returns the XML.
      requestBody:
        content:
          application/json:
            schema:
              type: object
        description: "{ \\"
        required: true
      responses:
        "200":
          description: '{ \"xml\": \"<EntityDescriptor ...>\" }'
          content:
            application/json:
              schema:
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "502":
          description: Fetch failed
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Fetch IdP metadata XML
      tags:
        - auth-providers
  /api/v1/auth/oidc/callback:
    get:
      description: Handles the OIDC authorization callback and creates an API session.
      parameters:
        - description: OIDC authorization code
          in: query
          name: code
          schema:
            type: string
        - description: OIDC state
          in: query
          name: state
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete OIDC login
      tags:
        - auth
  /api/v1/auth/oidc/login:
    get:
      description: Redirects the browser to the configured OIDC identity provider.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Start OIDC login
      tags:
        - auth
  /api/v1/auth/saml/acs:
    post:
      description: Handles the SAML assertion consumer service callback and creates an
        API session.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                SAMLResponse:
                  description: SAML response assertion
                  type: string
                RelayState:
                  description: SAML relay state
                  type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete SAML login
      tags:
        - auth
  /api/v1/auth/saml/login:
    get:
      description: Redirects the browser to the configured SAML identity provider.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Start SAML login
      tags:
        - auth
  /api/v1/auth/saml/metadata:
    get:
      description: Returns service provider metadata for SAML identity provider
        registration.
      responses:
        "200":
          description: OK
          content:
            application/xml:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Get SAML metadata
      tags:
        - auth
  "/api/v1/carves/{env}":
    get:
      description: Returns paginated file carves for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarvesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List file carves
      tags:
        - carves
    post:
      description: Starts a new file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiDistributedQueryRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiQueriesResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Run file carve
      tags:
        - carves
  "/api/v1/carves/{env}/{action}/{name}":
    post:
      description: Deletes, expires, or otherwise acts on a file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve action
          in: path
          name: action
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute carve action
      tags:
        - carves
  "/api/v1/carves/{env}/{name}":
    get:
      description: Returns a file carve and the files produced by it.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarveDetailResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get file carve
      tags:
        - carves
  "/api/v1/carves/{env}/archive/{name}":
    get:
      description: Downloads the archive for a completed file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        "400":
          description: Bad request
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Download carve archive
      tags:
        - carves
  "/api/v1/carves/{env}/list":
    get:
      description: Returns paginated file carves for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarvesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List file carves
      tags:
        - carves
  "/api/v1/carves/{env}/queries/{target}":
    get:
      description: Returns file carve queries by target and environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve target filter
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List carve queries
      tags:
        - carves
  /api/v1/carves/samples:
    get:
      description: Returns sample carve path templates.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/carves.CarveSample"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List carve samples
      tags:
        - carves
  /api/v1/checks-auth:
    get:
      description: Returns API availability for an authenticated user.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Authenticated API check
      tags:
        - checks
  /api/v1/checks-no-auth:
    get:
      description: Returns API availability without requiring authentication.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Unauthenticated API check
      tags:
        - checks
  /api/v1/environments:
    get:
      description: Returns environments visible to the authenticated user.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.TLSEnvironmentView"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List environments
      tags:
        - environments
    post:
      description: Creates an environment.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvCreateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create environment
      tags:
        - environments
  "/api/v1/environments/{env}":
    delete:
      description: Deletes an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete environment
      tags:
        - environments
    get:
      description: Returns one environment by name or UUID.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.TLSEnvironmentView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment
      tags:
        - environments
    patch:
      description: Updates an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment
      tags:
        - environments
  "/api/v1/environments/{env}/enroll/{action}":
    post:
      description: Extends, expires, rotates, or updates enrollment values for an
        environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Enrollment action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiActionsRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute enrollment action
      tags:
        - environments
  "/api/v1/environments/{env}/enroll/{target}":
    get:
      description: Returns enrollment helper values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Enrollment target
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get enrollment values
      tags:
        - environments
  "/api/v1/environments/{env}/packages":
    get:
      description: Returns all enrolling packages for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/environments.EnvironmentPackage"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List enrolling packages
      tags:
        - environments
    post:
      description: Adds a new enrolling package to an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiAddPackageRequest"
        description: Request body
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.EnvironmentPackage"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Add enrolling package
      tags:
        - environments
  "/api/v1/environments/{env}/packages/{id}":
    delete:
      description: Removes an enrolling package from an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Package ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No Content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove enrolling package
      tags:
        - environments
  "/api/v1/environments/{env}/remove/{action}":
    post:
      description: Extends, expires, rotates, or updates removal values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Removal action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiActionsRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute removal action
      tags:
        - environments
  "/api/v1/environments/{env}/remove/{target}":
    get:
      description: Returns removal helper values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Removal target
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get removal values
      tags:
        - environments
  /api/v1/environments/actions:
    post:
      description: Creates or modifies an environment using the legacy action endpoint.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiEnvRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute environment action
      tags:
        - environments
  "/api/v1/environments/config/{env}":
    get:
      description: Returns raw osquery config sections for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment config
      tags:
        - environments
    patch:
      description: Updates raw osquery config sections for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvConfigPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment config
      tags:
        - environments
  "/api/v1/environments/expiration/{env}":
    patch:
      description: Updates enrollment expiration state for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvExpirationPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment expiration
      tags:
        - environments
  "/api/v1/environments/inactive-hours/{env}":
    delete:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Reset environment inactivity threshold
      tags:
        - environments
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment inactivity threshold
      tags:
        - environments
    put:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.InactiveHoursRequest"
        description: Positive whole hours (1 to 2562047)
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set environment inactivity threshold
      tags:
        - environments
  "/api/v1/environments/intervals/{env}":
    patch:
      description: Updates osquery interval settings for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvIntervalsPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment intervals
      tags:
        - environments
  "/api/v1/environments/map/{target}":
    get:
      description: Returns an environment lookup map by target key.
      parameters:
        - description: "Map target: id, name, or uuid"
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: "#/components/schemas/environments.NameUUID"
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Map environments
      tags:
        - environments
  "/api/v1/environments/packages/{env}/{id}":
    patch:
      description: Updates the URL of an existing enrolling package.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Package ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiUpdatePackageRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.EnvironmentPackage"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update enrolling package URL
      tags:
        - environments
  /api/v1/events:
    get:
      description: Best-effort SSE invalidation hints. No replay; refetch REST
        snapshots after stream.ready and retain polling. Requires the
        corresponding environment query/carve/admin permissions. Session-scoped
        console and file_explorer topics require console_session or
        file_explorer_session respectively. Alerts may use env=all.
        service_commands and fleet require super-admin permissions and env=all.
      parameters:
        - description: Environment name or UUID; use all only with topic=alerts,
            topic=service_commands, or topic=fleet
          in: query
          name: env
          required: true
          schema:
            type: string
        - description: "Topics: queries, carves, console, file_explorer, alerts,
            service_commands, fleet"
          in: query
          name: topic
          required: true
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: Console session id required when subscribing to topic=console
          in: query
          name: console_session
          schema:
            type: integer
        - description: File explorer session id required when subscribing to
            topic=file_explorer
          in: query
          name: file_explorer_session
          schema:
            type: integer
      responses:
        "200":
          description: "SSE stream: stream.ready, resource.changed, auth.expired"
          content:
            text/event-stream json:
              schema:
                type: string
        "400":
          description: Bad Request
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too Many Requests
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Subscribe to resource change notifications
      tags:
        - Events
  /api/v1/features:
    get:
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.FeaturesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get enabled API features
      tags:
        - Features
  /api/v1/health/status:
    get:
      description: Component health, per-service runtime detail, live-update transport
        counters, and upgrade status. Admin only.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.healthStatusResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Health reporting disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Deployment health
      tags:
        - health
  /api/v1/log-sinks:
    get:
      description: Returns log sink rows, optionally filtered by environment. Secrets
        are redacted unless reveal=1 is passed by an admin.
      parameters:
        - description: Environment ID; omit to list all environments
          in: query
          name: env
          schema:
            type: integer
        - description: Pass 1 to include secret fields in the config (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.logSinkDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List log sinks
      tags:
        - log-sinks
    post:
      description: Creates a new log sink instance for the given environment (or
        global when environment_id is 0).
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkCreateRequest"
        description: Request body
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create a log sink
      tags:
        - log-sinks
  "/api/v1/log-sinks/{id}":
    delete:
      description: Deletes a log sink by ID. Deletion takes effect on the next apply/reload.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete a log sink
      tags:
        - log-sinks
    get:
      description: Returns a single log sink by ID. Secrets are redacted unless
        reveal=1 is passed by an admin.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Pass 1 to include secret fields (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one log sink
      tags:
        - log-sinks
    put:
      description: Replaces an existing log sink's mutable fields. A secret field set
        to "***" is merged from the previously stored value.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update a log sink
      tags:
        - log-sinks
  "/api/v1/log-sinks/{id}/revert":
    post:
      description: Flips a sink's source back to "service" so the next reload re-syncs
        the config from the service configuration. No config change happens here
        — the sync runs in osctrl-tls during the reload.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Revert sink to service config
      tags:
        - log-sinks
  /api/v1/log-sinks/apply:
    post:
      description: Queues a reload-log-sinks service command for osctrl-tls. The TLS
        process rebuilds its per-environment exporter map from the log_sinks
        table and atomically swaps it in, closing the old sinks. In-flight logs
        to the old sinks may be dropped during the swap; no restart is required.
      responses:
        "202":
          description: Reload requested
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigApplyResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service commands unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply log sink changes (hot reload)
      tags:
        - log-sinks
  /api/v1/log-sinks/clone:
    post:
      description: Copies all log sinks from a source environment (use 0 for global)
        to a target environment. With overwrite=false returns 409 if the target
        already has sinks.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkCloneRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.logSinkDTO"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Target has sinks
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Clone sinks from one environment to another
      tags:
        - log-sinks
  /api/v1/log-sinks/types:
    get:
      description: "Returns the sink type registry: type, description, whether the
        config carries secrets, and which JSON keys hold them."
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.LogSinkTypeSpec"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List supported log sink types
      tags:
        - log-sinks
  /api/v1/login:
    post:
      description: Authenticates an API user and returns a JWT token.
      requestBody:
        $ref: "#/components/requestBodies/types.ApiLoginRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log in
      tags:
        - auth
  "/api/v1/login/{env}":
    post:
      description: Authenticates an API user and returns a JWT token.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          schema:
            type: string
          required: true
      requestBody:
        $ref: "#/components/requestBodies/types.ApiLoginRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log in
      tags:
        - auth
  /api/v1/login/environments:
    get:
      description: Returns pre-auth environment choices for the login UI.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.LoginEnvironment"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: List login environments
      tags:
        - auth
  /api/v1/login/mfa:
    post:
      description: Answers an MFA challenge with a TOTP or recovery code and returns a
        JWT token.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.MFALoginRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete a login with a second factor
      tags:
        - auth
  /api/v1/login/mfa/enroll/begin:
    post:
      description: Returns a TOTP secret for a user who must enroll before logging in.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAEnrollRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFAEnrollBeginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin enrollment during login
      tags:
        - auth
  /api/v1/login/mfa/enroll/finish:
    post:
      description: Confirms a TOTP enrollment and returns a JWT token plus recovery codes.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAEnrollRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish enrollment during login
      tags:
        - auth
  /api/v1/login/mfa/webauthn/begin:
    post:
      description: Returns WebAuthn assertion options for an MFA challenge.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin a WebAuthn login ceremony
      tags:
        - auth
  /api/v1/login/mfa/webauthn/finish:
    post:
      description: Validates a WebAuthn assertion and returns a JWT token.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish a WebAuthn login ceremony
      tags:
        - auth
  /api/v1/logout:
    post:
      description: Clears API session cookies and revokes the active token when present.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.LogoutResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log out
      tags:
        - auth
  "/api/v1/logs/{type}/{env}/{uuid}":
    get:
      description: Returns recent status or result logs for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: "Log type: status or result"
          in: path
          name: type
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Maximum number of log rows
          in: query
          name: limit
          schema:
            type: integer
        - description: RFC3339 lower bound
          in: query
          name: since
          schema:
            type: string
        - description: Free-text search (substring, case-insensitive)
          in: query
          name: q
          schema:
            type: string
        - description: Severity filter for status logs (0=info, 1=warning, 2=error)
          in: query
          name: severity
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.NodeLogsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node logs
      tags:
        - logs
  /api/v1/mfa:
    get:
      description: Returns the second factors enrolled on the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFAStatusResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Multi-factor status
      tags:
        - mfa
  /api/v1/mfa/recovery:
    post:
      description: Invalidates the existing recovery codes and returns a new set.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFARecoveryCodesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Regenerate recovery codes
      tags:
        - mfa
  /api/v1/mfa/totp:
    delete:
      description: Disables the authenticator-app factor after confirming the account
        password.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Remove TOTP
      tags:
        - mfa
    post:
      description: Generates a TOTP secret and provisioning URI for the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFATOTPBeginResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin TOTP enrollment
      tags:
        - mfa
  /api/v1/mfa/totp/verify:
    post:
      description: Verifies a code from the authenticator app and returns recovery codes.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.MFACodeRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFARecoveryCodesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Confirm TOTP enrollment
      tags:
        - mfa
  /api/v1/mfa/webauthn:
    post:
      description: Returns WebAuthn creation options for the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin WebAuthn registration
      tags:
        - mfa
  "/api/v1/mfa/webauthn/{id}":
    delete:
      description: Deletes one registered passkey or security key after confirming the
        account password.
      parameters:
        - description: Credential ID
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Remove a WebAuthn credential
      tags:
        - mfa
  /api/v1/mfa/webauthn/verify:
    post:
      description: Validates a WebAuthn attestation and stores the credential.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish WebAuthn registration
      tags:
        - mfa
  "/api/v1/nodes/{env}":
    get:
      description: Returns paginated, filtered, and sorted nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Node status filter
          in: query
          name: status
          schema:
            type: string
        - description: Platform filter
          in: query
          name: platform
          schema:
            type: string
        - description: Sort field
          in: query
          name: sort
          schema:
            type: string
        - description: Sort order
          in: query
          name: order
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List paginated nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/active":
    get:
      description: Returns active enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List active nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/all":
    get:
      description: Returns all enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List all nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/delete":
    post:
      description: Deletes a node from an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiNodeGenericRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete node
      tags:
        - nodes
  "/api/v1/nodes/{env}/inactive":
    get:
      description: Returns inactive enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List inactive nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{node}":
    get:
      description: Returns a single enrolled node in an environment, including
        admin-only detail fields.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID, hostname, or local name
          in: path
          name: node
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/posture":
    get:
      description: Returns security and compliance posture data for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/posture.NodePosture"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node posture
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/posture/score":
    get:
      description: Returns a security and compliance risk score based on posture data.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/posture.PostureScore"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node posture risk score
      tags:
        - nodes
  "/api/v1/nodes/{env}/tag":
    post:
      description: Adds or updates a tag on a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiNodeTagRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Tag node
      tags:
        - nodes
  /api/v1/nodes/lookup:
    post:
      description: Looks up a node by UUID, hostname, or local name.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiLookupRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/nodes.OsqueryNode"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Lookup node
      tags:
        - nodes
  /api/v1/osquery/tables:
    get:
      description: Returns the osquery schema table metadata known to the API.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.OsqueryTable"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List osquery tables
      tags:
        - osquery
  "/api/v1/platforms/{env}":
    get:
      description: Returns platform counts for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.PlatformCounts"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List platforms
      tags:
        - platforms
  /api/v1/posture/profiles:
    get:
      description: Returns predefined posture check profiles for different node types.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/posture.PostureProfile"
                type: array
      security:
        - ApiKeyAuth: []
      summary: List posture profiles
      tags:
        - posture
  "/api/v1/posture/profiles/{id}":
    get:
      description: Returns a single posture check profile by ID.
      parameters:
        - description: Profile ID
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/posture.PostureProfile"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get posture profile
      tags:
        - posture
  "/api/v1/queries/{env}":
    get:
      description: Returns on-demand queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List queries
      tags:
        - queries
    post:
      description: Starts a new distributed query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiDistributedQueryRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiQueriesResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Run query
      tags:
        - queries
  "/api/v1/queries/{env}/{action}/{name}":
    post:
      description: Deletes, expires, or otherwise acts on an on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query action
          in: path
          name: action
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute query action
      tags:
        - queries
  "/api/v1/queries/{env}/{name}":
    get:
      description: Returns a single on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/queries.DistributedQuery"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get query
      tags:
        - queries
  "/api/v1/queries/{env}/list/{target}":
    get:
      description: Returns paginated on-demand queries by target and environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query target filter
          in: path
          name: target
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Sort field
          in: query
          name: sort
          schema:
            type: string
        - description: Sort order
          in: query
          name: order
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.QueriesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List paginated queries
      tags:
        - queries
  "/api/v1/queries/{env}/results/{name}":
    get:
      description: Returns paginated results for an on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: RFC3339 lower bound
          in: query
          name: since
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.QueryResultsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get query results
      tags:
        - queries
  "/api/v1/queries/{env}/results/csv/{name}":
    get:
      description: Streams query results as CSV.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            text/csv:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Export query results CSV
      tags:
        - queries
  /api/v1/queries/samples:
    get:
      description: Returns sample query templates.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.QuerySample"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List query samples
      tags:
        - queries
  "/api/v1/saved-queries/{env}":
    get:
      description: Returns paginated saved queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueriesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List saved queries
      tags:
        - saved-queries
    post:
      description: Creates a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SavedQueryCreateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueryView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create saved query
      tags:
        - saved-queries
  "/api/v1/saved-queries/{env}/{name}":
    delete:
      description: Deletes a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Saved query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete saved query
      tags:
        - saved-queries
    patch:
      description: Updates a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Saved query name
          in: path
          name: name
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SavedQueryUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueryView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update saved query
      tags:
        - saved-queries
  /api/v1/service-config:
    get:
      description: Returns all service configuration sections across all services.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/serviceconfig.ServiceConfig"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List all service config sections
      tags:
        - service-config
  "/api/v1/service-config/{service}":
    get:
      description: Returns all configuration sections for the given service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/serviceconfig.ServiceConfig"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service config sections for a service
      tags:
        - service-config
  "/api/v1/service-config/{service}/{section}":
    get:
      description: Returns a single configuration section by service and section name.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Section name
          in: path
          name: section
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/serviceconfig.ServiceConfig"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one service config section
      tags:
        - service-config
    put:
      description: Replaces an editable service config section's JSON value.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Section name
          in: path
          name: section
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ServiceConfigUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/serviceconfig.ServiceConfig"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update service config section
      tags:
        - service-config
  /api/v1/service-config/apply:
    post:
      description: Triggers a graceful service restart to apply DB-edited config changes.
      responses:
        "202":
          description: Restart triggered
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply config changes and restart
      tags:
        - service-config
  /api/v1/service-config/persist:
    post:
      description: Persists DB-edited config sections back to the service's YAML file.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ServiceConfigPersistRequest"
        description: Request body
      responses:
        "200":
          description: Written
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigPersistResponse"
        "202":
          description: Write queued
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigPersistResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Config file not writable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Write config changes to disk
      tags:
        - service-config
  "/api/v1/service-config/status/{service}":
    get:
      description: Reports unsaved DB changes and config file writability for a service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigStatusResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Service config file status
      tags:
        - service-config
  /api/v1/settings:
    get:
      description: Returns settings for all services.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List settings
      tags:
        - settings
  "/api/v1/settings/{service}":
    get:
      description: Returns settings for a service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service settings
      tags:
        - settings
  "/api/v1/settings/{service}/{env}":
    get:
      description: Returns settings for a service and environment.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service environment settings
      tags:
        - settings
  "/api/v1/settings/{service}/{name}":
    patch:
      description: Updates a mutable setting value.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Setting name
          in: path
          name: name
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SettingPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.SettingValue"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update setting
      tags:
        - settings
  /api/v1/stats:
    get:
      description: Returns cross-environment dashboard statistics.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.StatsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get dashboard stats
      tags:
        - stats
  "/api/v1/stats/activity/{env}":
    get:
      description: Returns activity buckets for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.ActivityBucket"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment activity
      tags:
        - stats
  "/api/v1/stats/activity/env-tiles/{env}":
    get:
      description: Returns Redis-backed hourly activity series for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/activity.EnvSeries"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment activity tiles
      tags:
        - stats
  "/api/v1/stats/activity/error-nodes/{env}":
    get:
      description: Returns nodes with the most ERROR-severity osquery status logs.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Days of history (default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.ErrorNodeRow"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Top erroring nodes for an environment
      tags:
        - stats
  "/api/v1/stats/activity/node-batch/{env}":
    get:
      description: Returns activity buckets for multiple nodes in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Comma-separated node UUIDs
          in: query
          name: uuids
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  items:
                    $ref: "#/components/schemas/handlers.NodeActivityBucket"
                  type: array
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity batch
      tags:
        - stats
  "/api/v1/stats/activity/node-tiles-batch/{env}":
    get:
      description: Returns Redis-backed hourly activity series for multiple nodes.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Comma-separated node UUIDs
          in: query
          name: uuids
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: "#/components/schemas/activity.NodeTileSeries"
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity tiles batch
      tags:
        - stats
  "/api/v1/stats/activity/node-tiles/{env}/{uuid}":
    get:
      description: Returns Redis-backed hourly activity series for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/activity.NodeTileSeries"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get per-node activity tiles
      tags:
        - stats
  "/api/v1/stats/activity/node/{env}/{uuid}":
    get:
      description: Returns activity buckets for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.NodeActivityBucket"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity
      tags:
        - stats
  /api/v1/stats/osquery-versions:
    get:
      description: Returns fleet-wide osquery version counts.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/nodes.OsqueryVersionCount"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get osquery version stats
      tags:
        - stats
  /api/v1/tags:
    get:
      description: Returns tags across environments.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/tags.AdminTag"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List tags
      tags:
        - tags
  "/api/v1/tags/{env}":
    get:
      description: Returns tags for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/tags.AdminTag"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List environment tags
      tags:
        - tags
  "/api/v1/tags/{env}/{action}":
    post:
      description: Creates, updates, deletes, or applies tags in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Tag action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiTagsRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute tag action
      tags:
        - tags
  "/api/v1/tags/{env}/{name}":
    get:
      description: Returns one tag by name for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Tag name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/tags.AdminTag"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment tag
      tags:
        - tags
  /api/v1/users:
    get:
      description: Returns API users.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.AdminUserView"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List users
      tags:
        - users
  "/api/v1/users/{username}":
    get:
      description: Returns an API user by username.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.AdminUserView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get user
      tags:
        - users
  "/api/v1/users/{username}/{action}":
    post:
      description: Creates, updates, deletes, or changes flags on a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
        - description: User action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiUserRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute user action
      tags:
        - users
  "/api/v1/users/{username}/permissions":
    get:
      description: Returns per-environment permissions for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.GetPermissionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get user permissions
      tags:
        - users
    post:
      description: Sets per-environment permissions for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SetPermissionsRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvAccessView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set user permissions
      tags:
        - users
  "/api/v1/users/{username}/permissions/all":
    post:
      description: Sets permissions across all environments for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SetPermissionsAllRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SetPermissionsAllResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set all user permissions
      tags:
        - users
  "/api/v1/users/{username}/token":
    delete:
      description: Deletes an API token for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete user token
      tags:
        - users
  "/api/v1/users/{username}/token/refresh":
    post:
      description: Refreshes an API token for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.TokenResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Refresh user token
      tags:
        - users
  /api/v1/users/me:
    get:
      description: Returns the currently authenticated user profile.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.UserMeResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get current user
      tags:
        - users
    patch:
      description: Updates the current user's profile fields.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.UserMePatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.UserMeResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update current user
      tags:
        - users
  /api/v1/users/me/password:
    post:
      description: Changes the current user's password.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.PasswordChangeRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Change current user password
      tags:
        - users
  /error:
    get:
      description: Returns a generic API error response.
      responses:
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                type: string
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API error response
      tags:
        - system
  /forbidden:
    get:
      description: Returns a generic forbidden response.
      responses:
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                type: string
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API forbidden response
      tags:
        - system
  /health:
    get:
      description: Returns the API health response.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "204":
          description: Degraded — backend unreachable, serving from cache
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API health check
      tags:
        - system
servers:
  - url: /
components:
  requestBodies:
    handlers.MFAWebAuthnRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAWebAuthnRequest"
      description: Request body
      required: true
    types.ApiActionsRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiActionsRequest"
      description: Request body
      required: true
    types.AlertChannelCreateRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.AlertChannelCreateRequest"
      description: Request body
      required: true
    types.ApiDistributedQueryRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiDistributedQueryRequest"
      description: Request body
      required: true
    types.AlertRuleCreateRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.AlertRuleCreateRequest"
      description: Request body
      required: true
    types.ApiLoginRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiLoginRequest"
      description: Request body
      required: true
    handlers.MFAEnrollRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAEnrollRequest"
      description: Request body
      required: true
    handlers.MFAPasswordRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAPasswordRequest"
      description: Request body
      required: true
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: Authorization
      type: apiKey
  schemas:
    activity.EnvSeries:
      properties:
        bucket_seconds:
          type: integer
        config:
          items:
            type: integer
          type: array
        enroll:
          items:
            type: integer
          type: array
        query_read:
          items:
            type: integer
          type: array
        query_write:
          items:
            type: integer
          type: array
        result:
          items:
            type: integer
          type: array
        start:
          type: string
        status:
          items:
            type: integer
          type: array
        status_error:
          items:
            type: integer
          type: array
        total:
          items:
            type: integer
          type: array
      type: object
    activity.NodeTileSeries:
      properties:
        bucket_seconds:
          type: integer
        config:
          items:
            type: integer
          type: array
        enroll:
          items:
            type: integer
          type: array
        query_read:
          items:
            type: integer
          type: array
        query_write:
          items:
            type: integer
          type: array
        result:
          items:
            type: integer
          type: array
        start:
          type: string
        status:
          items:
            type: integer
          type: array
        status_error:
          items:
            type: integer
          type: array
        total:
          items:
            type: integer
          type: array
      type: object
    alerts.AlertHistory:
      properties:
        channel_id:
          type: integer
        channel_name:
          type: string
        created_at:
          type: string
        detail:
          description: Detail is the rendered match context (bounded at match time).
          type: string
        entity:
          description: |-
            Entity is what matched: a hostname, a query name, or "node" for
            inactive/recovered rules. Part of the Redis dedupe key.
          type: string
        environment:
          type: string
        id:
          type: integer
        node_uuid:
          type: string
        rule_id:
          description: |-
            RuleID / ChannelID are denormalized as uint rather than FKs so
            deleting a rule or channel does not cascade-delete history.
          type: integer
        rule_name:
          type: string
      type: object
    carves.CarveSample:
      properties:
        category:
          $ref: "#/components/schemas/carves.CarveSampleCategory"
        label:
          type: string
        notes:
          description: |-
            Notes is a brief operator-facing description of why this file is
            worth grabbing during an investigation. Surfaced as a tooltip in
            the SPA template row.
          type: string
        path:
          type: string
        platform:
          $ref: "#/components/schemas/carves.CarveSamplePlatform"
      type: object
    carves.CarveSampleCategory:
      enum:
        - auth
        - logs
        - registry
        - keychain
        - history
        - config
      type: string
      x-enum-varnames:
        - CarveCategoryAuth
        - CarveCategoryLogs
        - CarveCategoryRegistry
        - CarveCategoryKeychain
        - CarveCategoryHistory
        - CarveCategoryConfig
    carves.CarveSamplePlatform:
      enum:
        - linux
        - darwin
        - windows
      type: string
      x-enum-varnames:
        - CarvePlatformLinux
        - CarvePlatformDarwin
        - CarvePlatformWindows
    environments.EnvironmentPackage:
      properties:
        architecture:
          type: string
        created_at:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        is_default:
          type: boolean
        type:
          type: string
        updated_at:
          type: string
        url:
          type: string
      type: object
    environments.NameUUID:
      properties:
        id:
          type: integer
        name:
          type: string
        uuid:
          type: string
      type: object
    environments.TLSEnvironment:
      properties:
        accept_enrolls:
          type: boolean
        atc:
          type: string
        carver_block_path:
          type: string
        carver_init_path:
          type: string
        carves_tls:
          type: boolean
        certificate:
          type: string
        config_interval:
          type: integer
        config_path:
          type: string
        config_tls:
          type: boolean
        configuration:
          type: string
        created_at:
          type: string
        deb_package:
          type: string
        debug_http:
          type: boolean
        decorators:
          type: string
        enroll_expire:
          type: string
        enroll_path:
          type: string
        enroll_secret_path:
          type: string
        flags:
          type: string
        hostname:
          type: string
        icon:
          type: string
        id:
          type: integer
        log_interval:
          type: integer
        log_path:
          type: string
        logging_tls:
          type: boolean
        msi_package:
          type: string
        name:
          type: string
        options:
          type: string
        packs:
          type: string
        pkg_package:
          type: string
        query_interval:
          type: integer
        query_read_path:
          type: string
        query_tls:
          type: boolean
        query_write_path:
          type: string
        remove_expire:
          type: string
        remove_secret_path:
          type: string
        rpm_package:
          type: string
        schedule:
          type: string
        secret:
          type: string
        type:
          type: string
        updated_at:
          type: string
        user_id:
          type: integer
        uuid:
          type: string
      type: object
    gorm.DeletedAt:
      properties:
        time:
          type: string
        valid:
          description: Valid is true if Time is not NULL
          type: boolean
      type: object
    handlers.ActivityBucket:
      properties:
        bucket_start:
          type: string
        carve:
          type: integer
        config:
          type: integer
        enroll:
          type: integer
        query:
          type: integer
      type: object
    handlers.EnvStats:
      properties:
        active:
          type: integer
        active_carves:
          type: integer
        active_queries:
          type: integer
        inactive:
          type: integer
        inactive_hours:
          description: InactiveHours is the effective threshold for this environment,
            including inheritance.
          type: integer
        name:
          type: string
        platform_counts:
          allOf:
            - $ref: "#/components/schemas/nodes.PlatformCounts"
          description: >-
            PlatformCounts buckets the env's nodes by OS family (linux / darwin
            /

            windows / other). Drives the Nodes-table QuickFilters chip row. Counts

            are total (active + inactive), since the filter chip lists all nodes

            of that platform regardless of staleness — the Active/Inactive toggle

            is independent.
        total:
          type: integer
        uuid:
          type: string
      type: object
    handlers.ErrorNodeRow:
      properties:
        errors:
          type: integer
        hostname:
          type: string
        uuid:
          type: string
      type: object
    handlers.FeaturesResponse:
      properties:
        accelerated:
          type: boolean
        alerts:
          description: |-
            Alerts gates the Alerts section in the SPA. Tied to
            --alerts-enabled — when false the /api/v1/alerts routes are not
            registered and the alert tables are not created.
          type: boolean
        auth_providers:
          type: boolean
        console:
          type: boolean
        event_topics:
          items:
            type: string
          type: array
        events:
          type: boolean
        file_explorer:
          type: boolean
        health:
          description: >-
            Health gates the Health section in the SPA. Tied to --health-enabled
            —

            when false the /api/v1/health routes are not registered.
          type: boolean
        log_sinks:
          description: |-
            LogSinks gates the Log Sinks section in the SPA. Tied to the same
            flag as ServiceConfig — the log_sinks routes are registered
            alongside the service-config routes.
          type: boolean
        posture:
          type: boolean
        service_config:
          description: >-
            ServiceConfig gates the whole Service Config section in the SPA.
            When

            false the /api/v1/service-config routes are not registered at all.
          type: boolean
      type: object
    handlers.InactiveHoursRequest:
      properties:
        inactive_hours:
          maximum: 2562047
          minimum: 1
          type: integer
      required:
        - inactive_hours
      type: object
    handlers.LogoutResponse:
      properties:
        auth_source:
          type: string
        idp_client_id:
          type: string
        idp_id_token_hint:
          type: string
        idp_logout_url:
          type: string
      type: object
    handlers.MFACodeRequest:
      properties:
        code:
          type: string
      type: object
    handlers.MFACredential:
      properties:
        created_at:
          type: string
        id:
          type: string
        last_used_at:
          type: string
        name:
          type: string
      type: object
    handlers.MFAEnrollBeginResponse:
      properties:
        qr:
          description: QR is the provisioning URI as a PNG data URI, ready for an <img>.
          type: string
        secret:
          type: string
        uri:
          type: string
      type: object
    handlers.MFAEnrollRequest:
      properties:
        challenge:
          type: string
        code:
          type: string
      type: object
    handlers.MFALoginRequest:
      properties:
        challenge:
          type: string
        code:
          type: string
        method:
          description: Method is "totp" or "recovery".
          type: string
      type: object
    handlers.MFAPasswordRequest:
      properties:
        password:
          type: string
      type: object
    handlers.MFARecoveryCodesResponse:
      properties:
        recovery_codes:
          items:
            type: string
          type: array
      type: object
    handlers.MFAStatusResponse:
      properties:
        credentials:
          items:
            $ref: "#/components/schemas/handlers.MFACredential"
          type: array
        recovery_codes_left:
          type: integer
        required:
          description: |-
            Required mirrors the deployment-wide switch so the profile page can
            explain why a factor cannot be removed.
          type: boolean
        totp_enabled:
          type: boolean
        webauthn_available:
          type: boolean
      type: object
    handlers.MFATOTPBeginResponse:
      properties:
        qr:
          description: QR is the provisioning URI as a PNG data URI, ready for an <img>.
          type: string
        secret:
          type: string
        uri:
          type: string
      type: object
    handlers.MFAWebAuthnRequest:
      properties:
        challenge:
          type: string
        credential:
          type: object
        name:
          type: string
      type: object
    handlers.NodeActivityBucket:
      properties:
        bucket_start:
          type: string
        carve:
          type: integer
        config:
          type: integer
        query:
          type: integer
        result:
          type: integer
        status:
          type: integer
      type: object
    handlers.NodeLogsResponse:
      properties:
        env:
          type: string
        items:
          items:
            additionalProperties: {}
            type: object
          type: array
        limit:
          type: integer
        since:
          type: string
        type:
          type: string
        uuid:
          type: string
      type: object
    handlers.StatsResponse:
      properties:
        active_nodes:
          type: integer
        environments:
          description: Per-env breakdown, in stable alphabetical order by name.
          items:
            $ref: "#/components/schemas/handlers.EnvStats"
          type: array
        inactive_hours:
          description: InactiveHours is the global default only; node counts use each
            environment's effective threshold.
          type: integer
        inactive_nodes:
          type: integer
        platform_counts:
          allOf:
            - $ref: "#/components/schemas/nodes.PlatformCounts"
          description: Cross-env platform breakdown — sum of every accessible env's
            PlatformCounts.
        total_active_carves:
          description: TotalActiveCarves counts active carve-type queries.
          type: integer
        total_active_queries:
          description: TotalActiveQueries counts standard query-type active queries
            (excludes carves).
          type: integer
        total_nodes:
          description: Cross-env totals (the user's allowed envs only).
          type: integer
      type: object
    handlers.alertChannelDTO:
      properties:
        config:
          type: object
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    handlers.alertRuleDTO:
      properties:
        channel_ids:
          items:
            type: integer
          type: array
        cooldown_minutes:
          type: integer
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        id:
          type: integer
        info:
          type: string
        match_field:
          type: string
        match_type:
          type: string
        match_value:
          type: string
        name:
          type: string
        node_uuid:
          type: string
        source:
          type: string
        status_severity:
          type: string
        updated_at:
          type: string
      type: object
    handlers.healthStatusResponse:
      properties:
        components:
          items:
            $ref: "#/components/schemas/health.Component"
          type: array
        generated_at:
          type: string
        upgrade:
          $ref: "#/components/schemas/health.UpgradeInfo"
      type: object
    handlers.logSinkDTO:
      properties:
        bytes_sent:
          type: integer
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        exports_count:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        source:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    health.Component:
      properties:
        details:
          additionalProperties: {}
          type: object
        id:
          type: string
        name:
          type: string
        status:
          type: string
        summary:
          type: string
      type: object
    health.UpgradeInfo:
      properties:
        api_version:
          description: |-
            API and TLS expose the per-service versions behind Skew so the page
            can name both sides of a mismatch.
          type: string
        checked:
          type: boolean
        checked_at:
          type: string
        current:
          type: string
        latest:
          type: string
        more_information:
          type: string
        skew:
          type: boolean
        suggested:
          type: string
        tls_version:
          type: string
        up_to_date:
          type: boolean
      type: object
    nodes.OsqueryNode:
      properties:
        bytes_received:
          type: integer
        config_hash:
          type: string
        cpu:
          type: string
        created_at:
          type: string
        daemon_hash:
          type: string
        environment:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        hardware_serial:
          type: string
        hostname:
          type: string
        id:
          type: integer
        ip_address:
          type: string
        last_seen:
          type: string
        localname:
          type: string
        memory:
          type: string
        osquery_user:
          type: string
        osquery_version:
          type: string
        platform:
          type: string
        platform_version:
          type: string
        updated_at:
          type: string
        user_id:
          type: integer
        username:
          type: string
        uuid:
          type: string
      type: object
    nodes.OsqueryVersionCount:
      properties:
        count:
          type: integer
        version:
          type: string
      type: object
    nodes.PlatformCounts:
      properties:
        darwin:
          type: integer
        linux:
          type: integer
        other:
          type: integer
        windows:
          type: integer
      type: object
    posture.ControlResult:
      properties:
        category:
          description: posture category the evidence came from
          type: string
        control_id:
          description: e.g. "A.8.24" or "CC6.6"
          type: string
        description:
          type: string
        detail:
          description: human-readable explanation
          type: string
        framework:
          $ref: "#/components/schemas/posture.Framework"
        max_score:
          description: >-
            MaxScore is the risk points this control would contribute if it

            failed outright (its weight). A passing control still reports this so

            callers can renormalize the total after excluding controls — e.g. the

            SPA's "what if I ignore this check" recompute — without needing the

            evaluation rules themselves.
          type: integer
        score:
          description: 0 = pass, otherwise earned risk points
          type: integer
        severity:
          $ref: "#/components/schemas/posture.Severity"
        status:
          description: '"pass", "warn", "fail"'
          type: string
        title:
          type: string
      type: object
    posture.Framework:
      enum:
        - SOC2
        - ISO27001
      type: string
      x-enum-varnames:
        - FrameworkSOC2
        - FrameworkISO27001
    posture.NodePosture:
      properties:
        category:
          type: string
        created_at:
          type: string
        environment:
          type: string
        first_seen:
          description: FirstSeen is when this category was first observed for this node.
          type: string
        id:
          type: integer
        last_seen:
          type: string
        node_uuid:
          type: string
        query_name:
          description: QueryName is the full osquery scheduled-query name including prefix.
          type: string
        row_count:
          description: RowCount is the number of rows in the result (e.g. 3 packages, 5
            users).
          type: integer
        summary:
          description: |-
            Summary is a compact JSON snapshot of the result data. For small
            results this is the full columns array; for large results it's
            truncated to the first 100 rows to keep the record manageable.
          type: string
        updated_at:
          type: string
      type: object
    posture.PostureProfile:
      properties:
        description:
          type: string
        id:
          type: string
        name:
          type: string
        platform:
          type: string
        queries:
          additionalProperties:
            $ref: "#/components/schemas/posture.ProfileQuery"
          type: object
      type: object
    posture.PostureScore:
      properties:
        controls:
          items:
            $ref: "#/components/schemas/posture.ControlResult"
          type: array
        fail_count:
          type: integer
        node_uuid:
          type: string
        pass_count:
          type: integer
        risk_level:
          description: '"low", "medium", "high", "critical"'
          type: string
        timestamp:
          type: string
        total_score:
          description: 0-100 normalized, lower is better
          type: integer
        warn_count:
          type: integer
      type: object
    posture.ProfileQuery:
      properties:
        interval:
          type: integer
        platform:
          type: string
        query:
          type: string
        query_name:
          type: string
        snapshot:
          type: boolean
      type: object
    posture.Severity:
      enum:
        - critical
        - high
        - medium
        - low
      type: string
      x-enum-comments:
        SeverityCritical: immediate risk, must fix
        SeverityHigh: significant risk
        SeverityLow: minor risk
        SeverityMedium: moderate risk
      x-enum-descriptions:
        - immediate risk, must fix
        - significant risk
        - moderate risk
        - minor risk
      x-enum-varnames:
        - SeverityCritical
        - SeverityHigh
        - SeverityMedium
        - SeverityLow
    queries.DistributedQuery:
      properties:
        active:
          type: boolean
        carve_status:
          type: string
        completed:
          type: boolean
        created_at:
          type: string
        creator:
          type: string
        deleted:
          type: boolean
        environment_id:
          type: integer
        errors:
          type: integer
        executions:
          type: integer
        expected:
          type: integer
        expiration:
          type: string
        expired:
          type: boolean
        extra_data:
          type: string
        hidden:
          type: boolean
        id:
          type: integer
        name:
          type: string
        path:
          type: string
        protected:
          type: boolean
        query:
          type: string
        target:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    queries.QuerySample:
      properties:
        category:
          $ref: "#/components/schemas/queries.QuerySampleCategory"
        description:
          type: string
        name:
          type: string
        platforms:
          items:
            $ref: "#/components/schemas/queries.QuerySamplePlatform"
          type: array
        sql:
          type: string
      type: object
    queries.QuerySampleCategory:
      enum:
        - recon
        - processes
        - users
        - network
        - persistence
        - file_integrity
        - packages
      type: string
      x-enum-varnames:
        - CategoryRecon
        - CategoryProcesses
        - CategoryUsers
        - CategoryNetwork
        - CategoryPersistence
        - CategoryFileIntegrity
        - CategoryPackages
    queries.QuerySamplePlatform:
      enum:
        - linux
        - darwin
        - windows
      type: string
      x-enum-varnames:
        - PlatformLinux
        - PlatformDarwin
        - PlatformWindows
    serviceconfig.ServiceConfig:
      properties:
        createdAt:
          type: string
        deletedAt:
          $ref: "#/components/schemas/gorm.DeletedAt"
        editable:
          type: boolean
        environmentID:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        overrides:
          description: >-
            Overrides is a JSON array of the top-level fields an operator pinned
            in

            this section. Only pinned fields beat flags, environment variables and

            YAML at startup; every other field follows the process.


            Empty is meaningful and depends on Source:
              - source=yaml: nothing is pinned.
              - source=db:   a row written before pins existed (or replaced
                wholesale through the API), so EVERY field is pinned. That is the
                only reading that cannot silently drop an operator's edit, since the
                original YAML is gone once a row is overwritten.
          type: string
        service:
          type: string
        source:
          description: '"yaml" or "db"'
          type: string
        type:
          description: always "json" for now
          type: string
        updatedAt:
          type: string
        value:
          type: string
      type: object
    settings.InactivityPolicy:
      properties:
        inactive_hours:
          maximum: 2562047
          minimum: 1
          type: integer
        override_hours:
          maximum: 2562047
          minimum: 1
          type: integer
          nullable: true
        source:
          enum:
            - environment
            - global
            - default
          type: string
      type: object
    settings.SettingValue:
      properties:
        boolean:
          type: boolean
        createdAt:
          type: string
        deletedAt:
          $ref: "#/components/schemas/gorm.DeletedAt"
        environmentID:
          type: integer
        id:
          type: integer
        info:
          type: string
        integer:
          format: int64
          type: integer
        name:
          type: string
        service:
          type: string
        string:
          type: string
        type:
          type: string
        updatedAt:
          type: string
      type: object
    tags.AdminTag:
      properties:
        auto_tag:
          type: boolean
        cohort:
          type: boolean
        color:
          type: string
        created_at:
          type: string
        created_by:
          type: string
        custom_tag:
          type: string
        description:
          type: string
        environment_id:
          type: integer
        icon:
          type: string
        id:
          type: integer
        name:
          type: string
        tag_type:
          type: integer
        updated_at:
          type: string
      type: object
    types.AdminUserView:
      properties:
        admin:
          type: boolean
        auth_source:
          description: |-
            AuthSource is empty for the password-login path (the default)
            and "oidc" for users JIT-provisioned through the federated
            callback. Surfaced so the SPA Users page can show an "OIDC"
            badge alongside the existing admin/service labels.
          type: string
        created_at:
          type: string
        email:
          type: string
        environment_id:
          type: integer
        fullname:
          type: string
        id:
          type: integer
        service:
          type: boolean
        token_expire:
          type: string
        updated_at:
          type: string
        username:
          type: string
        uuid:
          type: string
      type: object
    types.AlertChannelCreateRequest:
      properties:
        config:
          type: object
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.AlertChannelTestRequest:
      properties:
        config:
          type: object
        id:
          type: integer
        type:
          type: string
      type: object
    types.AlertChannelTypeSpec:
      properties:
        description:
          type: string
        fields:
          items:
            $ref: "#/components/schemas/types.AlertFieldSpec"
          type: array
        has_secret:
          type: boolean
        secret_fields:
          items:
            type: string
          type: array
        type:
          type: string
      type: object
    types.AlertFieldSpec:
      properties:
        default: {}
        help:
          type: string
        label:
          type: string
        name:
          type: string
        placeholder:
          type: string
        required:
          type: boolean
        type:
          type: string
      type: object
    types.AlertRuleCreateRequest:
      properties:
        channel_ids:
          items:
            type: integer
          type: array
        cooldown_minutes:
          type: integer
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        match_field:
          type: string
        match_type:
          type: string
        match_value:
          type: string
        name:
          type: string
        node_uuid:
          description: |-
            NodeUUID optionally scopes the rule to one node (used by the node
            detail page's "Alert on this node" button). Empty = all nodes.
          type: string
        source:
          type: string
        status_severity:
          type: string
      type: object
    types.ApiActionsRequest:
      properties:
        certificate:
          type: string
        url_deb_pkg:
          type: string
        url_mac_pkg:
          type: string
        url_msi_pkg:
          type: string
        url_rpm_pkg:
          type: string
      type: object
    types.ApiAddPackageRequest:
      properties:
        architecture:
          type: string
        is_default:
          type: boolean
        type:
          type: string
        url:
          type: string
      type: object
    types.ApiDataResponse:
      properties:
        data:
          type: string
      type: object
    types.ApiDistributedQueryRequest:
      properties:
        environment_list:
          items:
            type: string
          type: array
        exp_hours:
          type: integer
        hidden:
          type: boolean
        host_list:
          items:
            type: string
          type: array
        path:
          type: string
        platform_list:
          items:
            type: string
          type: array
        query:
          type: string
        tag_list:
          items:
            type: string
          type: array
        uuid_list:
          items:
            type: string
          type: array
      type: object
    types.ApiEnvRequest:
      properties:
        action:
          type: string
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
        uuid:
          type: string
      type: object
    types.ApiErrorResponse:
      properties:
        code:
          type: string
        error:
          type: string
      type: object
    types.ApiGenericResponse:
      properties:
        message:
          type: string
      type: object
    types.ApiLoginRequest:
      properties:
        exp_hours:
          type: integer
        password:
          type: string
        username:
          type: string
      type: object
    types.ApiLoginResponse:
      properties:
        csrf_token:
          type: string
        token:
          type: string
      type: object
    types.ApiLookupRequest:
      properties:
        identifier:
          type: string
      type: object
    types.ApiNodeGenericRequest:
      properties:
        uuid:
          type: string
      type: object
    types.ApiNodeTagRequest:
      properties:
        custom:
          type: string
        tag:
          type: string
        type:
          type: integer
        uuid:
          type: string
      type: object
    types.ApiQueriesResponse:
      properties:
        query_name:
          type: string
      type: object
    types.ApiTagsRequest:
      properties:
        color:
          type: string
        custom:
          type: string
        description:
          type: string
        env:
          type: string
        icon:
          type: string
        name:
          type: string
        tagtype:
          type: integer
      type: object
    types.ApiUpdatePackageRequest:
      properties:
        url:
          type: string
      type: object
    types.ApiUserRequest:
      properties:
        admin:
          type: boolean
        admin_access:
          type: boolean
        api:
          type: boolean
        carve_access:
          type: boolean
        email:
          type: string
        environments:
          items:
            type: string
          type: array
        fullname:
          type: string
        not_admin:
          type: boolean
        not_service:
          type: boolean
        password:
          type: string
        query_access:
          type: boolean
        service:
          type: boolean
        user_access:
          type: boolean
        username:
          type: string
      type: object
    types.AuditLogView:
      properties:
        created_at:
          type: string
        env_uuid:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        line:
          type: string
        log_type:
          type: integer
        service:
          type: string
        severity:
          type: integer
        source_ip:
          type: string
        username:
          type: string
      type: object
    types.AuditLogsPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.AuditLogView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.BIOSInfo:
      properties:
        address:
          type: string
        date:
          type: string
        revision:
          type: string
        size:
          type: string
        vendor:
          type: string
        version:
          type: string
        volume_size:
          type: string
      type: object
    types.CarveDetailResponse:
      properties:
        files:
          items:
            $ref: "#/components/schemas/types.CarveFileView"
          type: array
        query:
          $ref: "#/components/schemas/types.DistributedQueryView"
      type: object
    types.CarveFileView:
      properties:
        archived:
          type: boolean
        block_size:
          type: integer
        carve_id:
          type: string
        carve_size:
          type: integer
        completed_at:
          type: string
        completed_blocks:
          type: integer
        created_at:
          type: string
        path:
          type: string
        session_id:
          type: string
        status:
          type: string
        total_blocks:
          type: integer
        uuid:
          type: string
      type: object
    types.CarvesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/queries.DistributedQuery"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.DistributedQueryView:
      properties:
        active:
          type: boolean
        carve_status:
          type: string
        completed:
          type: boolean
        created_at:
          type: string
        creator:
          type: string
        deleted:
          type: boolean
        environment_id:
          type: integer
        errors:
          type: integer
        executions:
          type: integer
        expected:
          type: integer
        expiration:
          type: string
        expired:
          type: boolean
        extra_data:
          type: string
        hidden:
          type: boolean
        id:
          type: integer
        name:
          type: string
        path:
          type: string
        protected:
          type: boolean
        query:
          type: string
        target:
          type: string
        targets:
          items:
            $ref: "#/components/schemas/types.QueryTargetView"
          type: array
        type:
          type: string
        updated_at:
          type: string
      type: object
    types.EnvAccessView:
      properties:
        admin:
          type: boolean
        carve:
          type: boolean
        query:
          type: boolean
        user:
          type: boolean
      type: object
    types.EnvConfigPatchRequest:
      properties:
        atc:
          type: string
        decorators:
          type: string
        flags:
          type: string
        options:
          type: string
        packs:
          type: string
        schedule:
          type: string
      type: object
    types.EnvConfigResponse:
      properties:
        atc:
          type: string
        decorators:
          type: string
        flags:
          type: string
        options:
          type: string
        packs:
          type: string
        schedule:
          type: string
      type: object
    types.EnvCreateRequest:
      properties:
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.EnvExpirationPatchRequest:
      properties:
        action:
          type: string
      type: object
    types.EnvIntervalsPatchRequest:
      properties:
        config_interval:
          type: integer
        log_interval:
          type: integer
        query_interval:
          type: integer
      type: object
    types.EnvUpdateRequest:
      properties:
        accept_enrolls:
          type: boolean
        debug_http:
          type: boolean
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.GetPermissionsResponse:
      properties:
        permissions:
          additionalProperties:
            $ref: "#/components/schemas/types.EnvAccessView"
          type: object
        username:
          type: string
      type: object
    types.LogSinkCloneRequest:
      properties:
        overwrite:
          type: boolean
        source_environment_id:
          type: integer
        target_environment_id:
          type: integer
      type: object
    types.LogSinkCreateRequest:
      properties:
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        type:
          type: string
      type: object
    types.LogSinkFieldSpec:
      properties:
        default: {}
        help:
          type: string
        label:
          type: string
        name:
          type: string
        options:
          items:
            type: string
          type: array
        placeholder:
          type: string
        required:
          type: boolean
        secret:
          type: boolean
        type:
          type: string
      type: object
    types.LogSinkTypeSpec:
      properties:
        categories:
          items:
            type: string
          type: array
        description:
          type: string
        fields:
          items:
            $ref: "#/components/schemas/types.LogSinkFieldSpec"
          type: array
        has_secret:
          type: boolean
        secret_fields:
          items:
            type: string
          type: array
        type:
          type: string
      type: object
    types.LogSinkUpdateRequest:
      properties:
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        enabled:
          type: boolean
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        type:
          type: string
      type: object
    types.LoginEnvironment:
      properties:
        name:
          type: string
        uuid:
          type: string
      type: object
    types.NodeEnrichment:
      properties:
        bios:
          $ref: "#/components/schemas/types.BIOSInfo"
        os:
          $ref: "#/components/schemas/types.OSInfo"
        osquery:
          $ref: "#/components/schemas/types.OsqueryRuntime"
        system:
          $ref: "#/components/schemas/types.SystemInfo"
      type: object
    types.NodeHealth:
      properties:
        reason:
          type: string
        signals:
          items:
            type: string
          type: array
        status:
          type: string
      type: object
    types.NodePostureSummary:
      properties:
        risk_level:
          type: string
      type: object
    types.NodeUptime:
      properties:
        days:
          type: integer
        hours:
          type: integer
        last_seen:
          type: string
        minutes:
          type: integer
        seconds:
          type: integer
        total_seconds:
          type: integer
      type: object
    types.NodeView:
      properties:
        bytes_received:
          type: integer
        config_hash:
          type: string
        country_code:
          type: string
        cpu:
          type: string
        created_at:
          type: string
        daemon_hash:
          type: string
        environment:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        hardware_serial:
          type: string
        health:
          $ref: "#/components/schemas/types.NodeHealth"
        hostname:
          type: string
        id:
          type: integer
        ip_address:
          type: string
        last_seen:
          type: string
        localname:
          type: string
        memory:
          type: string
        node_key:
          type: string
        osquery_user:
          type: string
        osquery_version:
          type: string
        platform:
          type: string
        platform_version:
          type: string
        posture:
          $ref: "#/components/schemas/types.NodePostureSummary"
        system_info:
          $ref: "#/components/schemas/types.NodeEnrichment"
        tags:
          items:
            $ref: "#/components/schemas/tags.AdminTag"
          type: array
        updated_at:
          type: string
        uptime:
          $ref: "#/components/schemas/types.NodeUptime"
        user_id:
          type: integer
        username:
          type: string
        uuid:
          type: string
      type: object
    types.NodesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.NodeView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.OSInfo:
      properties:
        codename:
          type: string
        major:
          type: string
        minor:
          type: string
        name:
          type: string
        patch:
          type: string
        platform:
          type: string
        platform_like:
          type: string
        version:
          type: string
      type: object
    types.OsqueryRuntime:
      properties:
        build_distro:
          type: string
        build_platform:
          type: string
        config_valid:
          type: string
        extensions:
          type: string
        start_time:
          type: string
        version:
          type: string
      type: object
    types.OsqueryTable:
      properties:
        cacheable:
          type: boolean
        columns:
          items:
            $ref: "#/components/schemas/types.OsqueryTableColumn"
          type: array
        description:
          type: string
        evented:
          type: boolean
        examples:
          items:
            type: string
          type: array
        filter:
          type: string
        name:
          type: string
        notes:
          type: string
        platforms:
          items:
            type: string
          type: array
        url:
          type: string
      type: object
    types.OsqueryTableColumn:
      properties:
        description:
          type: string
        hidden:
          type: boolean
        index:
          type: boolean
        name:
          type: string
        notes:
          type: string
        required:
          type: boolean
        type:
          type: string
      type: object
    types.PasswordChangeRequest:
      properties:
        current_password:
          type: string
        new_password:
          type: string
      type: object
    types.QueriesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/queries.DistributedQuery"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.QueryResultsResponse:
      properties:
        items:
          items:
            additionalProperties: {}
            type: object
          type: array
        page:
          type: integer
        page_size:
          type: integer
        since:
          type: string
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.QueryTargetView:
      properties:
        type:
          type: string
        value:
          type: string
      type: object
    types.SavedQueriesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.SavedQueryView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.SavedQueryCreateRequest:
      properties:
        name:
          type: string
        query:
          type: string
      type: object
    types.SavedQueryUpdateRequest:
      properties:
        query:
          type: string
      type: object
    types.SavedQueryView:
      properties:
        created_at:
          type: string
        creator:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        id:
          type: integer
        name:
          type: string
        query:
          type: string
        updated_at:
          type: string
      type: object
    types.ServiceCommandResponse:
      properties:
        action:
          type: string
        command_id:
          type: string
        consumed_at:
          type: string
        consumed_by:
          type: string
        created_at:
          type: string
        expires_at:
          type: string
        recovered_at:
          type: string
        recovered_by:
          type: string
        requested_by:
          type: string
        requested_from:
          type: string
        status:
          type: string
        target_service:
          type: string
      type: object
    types.ServiceConfigApplyResponse:
      properties:
        command:
          $ref: "#/components/schemas/types.ServiceCommandResponse"
        message:
          type: string
        service:
          type: string
      type: object
    types.ServiceConfigPersistRequest:
      properties:
        service:
          type: string
      type: object
    types.ServiceConfigPersistResponse:
      properties:
        command:
          $ref: "#/components/schemas/types.ServiceCommandResponse"
        message:
          type: string
        service:
          type: string
      type: object
    types.ServiceConfigStatusResponse:
      properties:
        checked_at:
          type: string
        file_path:
          type: string
        file_reason:
          type: string
        file_writable:
          type: boolean
        pending_changes:
          type: boolean
        service:
          type: string
      type: object
    types.ServiceConfigUpdateRequest:
      properties:
        patch:
          type: object
        reset:
          items:
            type: string
          type: array
        value:
          type: object
      type: object
    types.SetPermissionsAllRequest:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
      type: object
    types.SetPermissionsAllResponse:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
        total:
          type: integer
        updated:
          type: integer
      type: object
    types.SetPermissionsRequest:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
        env_uuid:
          type: string
      type: object
    types.SettingPatchRequest:
      properties:
        boolean:
          type: boolean
        integer:
          type: integer
        string:
          type: string
        type:
          type: string
      type: object
    types.SystemInfo:
      properties:
        computer_name:
          type: string
        cpu_brand:
          type: string
        cpu_logical_cores:
          type: string
        cpu_physical_cores:
          type: string
        cpu_subtype:
          type: string
        cpu_type:
          type: string
        hardware_model:
          type: string
        hardware_serial:
          type: string
        hardware_vendor:
          type: string
        hardware_version:
          type: string
        local_hostname:
          type: string
        physical_memory:
          type: string
      type: object
    types.TLSEnvironmentView:
      properties:
        accept_enrolls:
          type: boolean
        carves_tls:
          type: boolean
        config_interval:
          type: integer
        config_tls:
          type: boolean
        created_at:
          type: string
        debug_http:
          type: boolean
        enroll_expire:
          type: string
        hostname:
          type: string
        icon:
          type: string
        id:
          type: integer
        log_interval:
          type: integer
        logging_tls:
          type: boolean
        name:
          type: string
        query_interval:
          type: integer
        query_tls:
          type: boolean
        remove_expire:
          type: string
        type:
          type: string
        updated_at:
          type: string
        uuid:
          type: string
      type: object
    types.TokenResponse:
      properties:
        expires:
          type: string
        token:
          type: string
      type: object
    types.UserMePatchRequest:
      properties:
        email:
          type: string
        fullname:
          type: string
        preferred_language:
          description: |-
            PreferredLanguage is the UI language tag the operator picked.
            Validated against the supported-language list; an empty value
            leaves the stored preference unchanged (same semantics as the
            other patch fields).
          type: string
      type: object
    types.UserMeResponse:
      properties:
        admin:
          type: boolean
        email:
          type: string
        fullname:
          type: string
        last_access:
          type: string
        permissions:
          additionalProperties:
            $ref: "#/components/schemas/types.EnvAccessView"
          type: object
        preferred_language:
          description: |-
            PreferredLanguage mirrors AdminUser.PreferredLanguage — the
            UI language the operator picked. Empty means "no server-side
            preference"; the SPA falls back to its own detection.
          type: string
        service:
          type: boolean
        token_expire:
          type: string
        username:
          type: string
        uuid:
          type: string
      type: object