{"schemaVersion":1,"catalogId":"moco","title":"Mocó","branding":{"displayName":"Mocó","logoSrc":"/brand-assets/moco-3f0ad4320f75.svg","logoAlt":"Mocó","logoHomeHref":"","faviconHref":"/brand-assets/moco-3f0ad4320f75.svg"},"defaultDocumentKey":"public-next","profileId":"strict-v1","searchChild":"search/directory.json","documents":[{"publication":{"api":"internal","audience":"internal","channel":"branch","repositoryURL":"https://github.com/araihu/moco","ref":"refs/heads/main","commit":"d07ca7a9f2690ffc75e8a6ebf6aaea574daea6f4","sourcePath":"openapi/internal.yaml"},"key":"internal-next","sourcePath":"internal-next.json","title":"Mocó Internal Operations API","apiVersion":"0.9.0","branding":{"displayName":"","logoSrc":"","logoAlt":"","logoHomeHref":"","faviconHref":""},"overview":{"anchor":"overview","href":"?selected=overview#overview","headingId":"overview-heading","heading":"Mocó Internal Operations API","headingLevel":2,"description":"Process probes, deployment-scoped authorization administration, and a\nrestricted request audit ledger for security observability. The audit\noperation is not a reconciliation/change feed; controllers and operators\nuse the public watch endpoint and relist contract for convergence. A\nbounded local retention operation removes events before an operator-supplied\ncutoff without changing public resource history.\nThe encryption operations report the shared root-key state and perform\nbounded online rewraps of vault data keys under the configured active\nroot-key era; key material is supplied only by deployment configuration and\nis never accepted or returned by this API.\nAdministrative operations are intended for a restricted deployment origin;\nthey never expose bearer token digests or request payloads.\n","termsOfService":"","specDownloadFilename":"internal-next.json","contact":{"name":"AraiHu","url":"https://github.com/araihu/moco","email":""},"license":{"name":"","url":"","identifier":""},"servers":[{"ordinal":0,"id":"server-0ed6a4449f076ffab47ae3a3e5ab027725d2fc310ec7eac41f75457052b219b0","url":"/","description":"Direct deployment origin, normally restricted by network policy.","variables":[]}]},"sourceChild":"sources/internal-next.json","schemaNodeShards":[{"path":"schema-nodes/internal-next/851b26bc9d2069889f4c94d74576597595e21b5cc82320782e606356f61d7d79.json","firstOrdinal":0,"lastOrdinal":77,"records":78,"length":58251,"sha256":"851b26bc9d2069889f4c94d74576597595e21b5cc82320782e606356f61d7d79"}],"operations":[{"detailId":"detail-sha256-1739d44d2617397e91fc2cb59934ecc25851793e03c454a44a29f1067d4c4076","operationId":"listAuditEvents","method":"GET","path":"/internal/v1/audit","title":"List request audit events","description":"Returns request metadata in ascending durable sequence order for security observability. Successful mutations and their event commit in one SQLite transaction before the success response; failed audit or commit rolls back the mutation. Startup metadata initialization uses a synthetic STARTUP event with route /internal/startup and principal system:startup. Read-only and rejected attempts are recorded independently after their response and may be missing on audit failure. This is not a reconciliation or change-feed operation; controllers and operators must use the public watch endpoint and relist contract for convergence. Query strings, request bodies, bearer credentials, and plaintext logical secret paths are never returned; secret paths are represented only by keyed HMAC-SHA-256 digests. Reads from this endpoint are not themselves recorded, so a tailing client cannot create self-events. The endpoint is internal and requires an explicit authorization policy for its exact path.","href":"documents/internal-next/?selected=detail-sha256-1739d44d2617397e91fc2cb59934ecc25851793e03c454a44a29f1067d4c4076#detail-sha256-1739d44d2617397e91fc2cb59934ecc25851793e03c454a44a29f1067d4c4076","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Audit"],"facets":[]},{"detailId":"detail-sha256-6b87449bbbec55a69eefaaf071b560c9fe2f60074dabd9d8d00c51f2ea593016","operationId":"purgeAuditEvents","method":"POST","path":"/internal/v1/audit/retention","title":"Purge one bounded audit-retention page","description":"Deletes at most 200 audit events strictly older than the required cutoff; destructive requests require a cutoff at least one hour old. This is local deployment maintenance, not a public resource mutation. Set dryRun=true to preview the current matching count without deleting anything, including with a more recent past cutoff; a dry-run result is informational, not a convergence loop. For a delete, repeat the same cutoff until complete is true and remaining is zero; the count is not a snapshot and newly inserted events can change it. Sequence numbers remain monotonic, the public resource-watch revision is unchanged, and event contents, credentials, plaintext secret paths, and key material are never accepted or returned. The endpoint requires an explicit exact-path POST policy and should be restricted to a deployment origin.","href":"documents/internal-next/?selected=detail-sha256-6b87449bbbec55a69eefaaf071b560c9fe2f60074dabd9d8d00c51f2ea593016#detail-sha256-6b87449bbbec55a69eefaaf071b560c9fe2f60074dabd9d8d00c51f2ea593016","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Audit"],"facets":[]},{"detailId":"detail-sha256-144760e3f585556f9a4375c21d0443408436646d5c2db445d45ed2d721d953c0","operationId":"getAuthorizationSnapshot","method":"GET","path":"/internal/v1/authorization","title":"Read the persisted authorization snapshot","description":"Returns the complete role-binding and policy snapshot without token digests. The ETag is the authoritative snapshot revision. A policy's optional secretPathPrefix narrows the decoded logical path or prefix query value for a secret item, metadata, or collection route and is a literal prefix match.","href":"documents/internal-next/?selected=detail-sha256-144760e3f585556f9a4375c21d0443408436646d5c2db445d45ed2d721d953c0#detail-sha256-144760e3f585556f9a4375c21d0443408436646d5c2db445d45ed2d721d953c0","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Authorization"],"facets":[]},{"detailId":"detail-sha256-30dcbc30f228a868ea91379139e501a77bbdf7389421628f12e3a38e64b195c6","operationId":"replaceAuthorizationSnapshot","method":"PUT","path":"/internal/v1/authorization","title":"Replace the persisted authorization snapshot","description":"Atomically replaces all role bindings and policies when If-Match identifies the revision observed by the writer. A committed change signals local reloaders and is discovered by shared-store polling in other processes. Set secretPathPrefix only on a policy for a canonical secret operation route; policies without it remain vault-scoped.","href":"documents/internal-next/?selected=detail-sha256-30dcbc30f228a868ea91379139e501a77bbdf7389421628f12e3a38e64b195c6#detail-sha256-30dcbc30f228a868ea91379139e501a77bbdf7389421628f12e3a38e64b195c6","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Authorization"],"facets":[]},{"detailId":"detail-sha256-a392317dfc0103520bdcc0b9820bb325f98e2eb6542a2efa01fea4c7000e1610","operationId":"rotateEncryptionKeys","method":"POST","path":"/internal/v1/encryption/rotation","title":"Rewrap one bounded page of vault data keys","description":"Rewraps persisted vault data keys whose root key ID is not the configured active era. The active and previous root keys are loaded from deployment configuration; this operation never accepts, returns, or logs key material. Repeating a page is safe. Use both returned keyset checkpoints to continue when hasMore is true, then run a fresh sweep until complete is true and remainingOldKeys is zero. The server persists an encryption-key epoch and rejects stale processes; the expected active ID and epoch are revalidated atomically in each key replacement, so all writers must start with the current epoch before maintenance. Rotation changes only wrapped-key bytes, not secret ciphertext, resource versions, or API representations, and may be run concurrently by workers in the same epoch.","href":"documents/internal-next/?selected=detail-sha256-a392317dfc0103520bdcc0b9820bb325f98e2eb6542a2efa01fea4c7000e1610#detail-sha256-a392317dfc0103520bdcc0b9820bb325f98e2eb6542a2efa01fea4c7000e1610","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Encryption"],"facets":[]},{"detailId":"detail-sha256-4cc7ab6c0a953b054dba36e76ec9a90d8e0071de25e2e69c07d66a0d9e292f8b","operationId":"getEncryptionStatus","method":"GET","path":"/internal/v1/encryption/status","title":"Read root-key rotation status","description":"Reads the current shared root-key era, deployment epoch, and count of vault keys still using an older era. The result is a point-in-time diagnostic, not a lock or a snapshot; it never accepts or returns key material, plaintext, ciphertext, or secret paths. Use it to coordinate bounded POST /internal/v1/encryption/rotation pages and remove an old deployment key only after a fresh sweep reports complete=true and remainingOldKeys=0. A concurrent writer or rotation worker can change the result immediately.","href":"documents/internal-next/?selected=detail-sha256-4cc7ab6c0a953b054dba36e76ec9a90d8e0071de25e2e69c07d66a0d9e292f8b#detail-sha256-4cc7ab6c0a953b054dba36e76ec9a90d8e0071de25e2e69c07d66a0d9e292f8b","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Encryption"],"facets":[]},{"detailId":"detail-sha256-087b16e6d8bbe95be37f2b8eb143913faa6c50cf2d95c8c396eab4c39f4b4e51","operationId":"getLiveness","method":"GET","path":"/livez","title":"Check process liveness","description":"Returns 200 while the server process can handle HTTP requests.","href":"documents/internal-next/?selected=detail-sha256-087b16e6d8bbe95be37f2b8eb143913faa6c50cf2d95c8c396eab4c39f4b4e51#detail-sha256-087b16e6d8bbe95be37f2b8eb143913faa6c50cf2d95c8c396eab4c39f4b4e51","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Health"],"facets":[]},{"detailId":"detail-sha256-5c4a835795fda832dfb5d1d68e2dc5dc0c10b66288a9220b0fe3bc8e7dae2212","operationId":"getReadiness","method":"GET","path":"/readyz","title":"Check traffic readiness","description":"Returns 200 when the instance can serve product traffic and 503 otherwise.\nThe body deliberately omits dependency and configuration details.\n","href":"documents/internal-next/?selected=detail-sha256-5c4a835795fda832dfb5d1d68e2dc5dc0c10b66288a9220b0fe3bc8e7dae2212#detail-sha256-5c4a835795fda832dfb5d1d68e2dc5dc0c10b66288a9220b0fe3bc8e7dae2212","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","deprecated":false,"tags":["Health"],"facets":[]}],"schemas":[{"detailId":"detail-sha256-ee344b05497e27563aeaac18d69c61799ead4fb906d007d552adec9ca8d427ac","name":"audit-event","description":"Request audit metadata without request bodies, query strings, credentials, or plaintext secret paths.","href":"documents/internal-next/?selected=detail-sha256-ee344b05497e27563aeaac18d69c61799ead4fb906d007d552adec9ca8d427ac#detail-sha256-ee344b05497e27563aeaac18d69c61799ead4fb906d007d552adec9ca8d427ac","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"2b48ffc28dd2148f1e57736e6d28ca4036e5ef26416c24807053990428f5b42a","projectionSHA256":"a80daedd4a4fdbb587b30e2ecfd48f40310aef80731c58e6c06466056a7d03a4"},{"detailId":"detail-sha256-87b357bc7563e58f419f8b83fac450621bd14176f08442c0c6f9e6fdb1d9e91b","name":"audit-event-list","description":"Ordered page from the append-only audit ledger.","href":"documents/internal-next/?selected=detail-sha256-87b357bc7563e58f419f8b83fac450621bd14176f08442c0c6f9e6fdb1d9e91b#detail-sha256-87b357bc7563e58f419f8b83fac450621bd14176f08442c0c6f9e6fdb1d9e91b","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"67be71c7aa30d458cf252f77153a1cf4e16e24618fc231614c078f454934919d","projectionSHA256":"4b72f81700d4f5f1444cec4cb0be06ee8737556033509d011ad327b1ca9d1025"},{"detailId":"detail-sha256-ec6cabfd415e0c2a2189725c196073ad78264cb5ddcb1336d93e297d87743c01","name":"audit-retention-result","description":"Bounded local audit retention result. It contains no event contents; remaining is a current diagnostic rather than a historical snapshot.","href":"documents/internal-next/?selected=detail-sha256-ec6cabfd415e0c2a2189725c196073ad78264cb5ddcb1336d93e297d87743c01#detail-sha256-ec6cabfd415e0c2a2189725c196073ad78264cb5ddcb1336d93e297d87743c01","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"8796bd84c6ccb2a57b63b24fa05354c4a682226e017b518f05bccaafc46fd12e","projectionSHA256":"17a53b629e7b8b8d9474f2aadf277717078bf48d3be9ed59795f454ea76309ab"},{"detailId":"detail-sha256-bfadbebadff37f7b23faf3d5dee335f20f66003ad16c4cd904aa9226b44564e0","name":"authorization-policy","description":"Allow policy for a role or principal, domain, path pattern, and HTTP method. Secret operation policies may additionally narrow access to a literal logical secret path prefix.","href":"documents/internal-next/?selected=detail-sha256-bfadbebadff37f7b23faf3d5dee335f20f66003ad16c4cd904aa9226b44564e0#detail-sha256-bfadbebadff37f7b23faf3d5dee335f20f66003ad16c4cd904aa9226b44564e0","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"7a62ba5d30129c0236ed259b6f59961d8c28d278bcc958b82f71324d260d1608","projectionSHA256":"6ca8c83c20330577f14a31128f2b4990e51bd029e3d659ac899b873308a18871"},{"detailId":"detail-sha256-90616eae885bbd7df90ab7bb93cc3978c98c2cb83dffd138081e588b8c9e93b2","name":"authorization-role-binding","description":"Principal-to-role binding scoped to one authorization domain.","href":"documents/internal-next/?selected=detail-sha256-90616eae885bbd7df90ab7bb93cc3978c98c2cb83dffd138081e588b8c9e93b2#detail-sha256-90616eae885bbd7df90ab7bb93cc3978c98c2cb83dffd138081e588b8c9e93b2","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"4a235627e147a86af56f8e4dadb0eeb990c2818af1f83d932877a25b3ec7bbd5","projectionSHA256":"2fec688137369bd87017e43957b1277fd8e55f8704f12f39dcf8af3d1a91c7bf"},{"detailId":"detail-sha256-e7478ae4e1bcb888c4e2581e11d9a1390525d3341102984f9d4869f796d014c0","name":"authorization-snapshot","description":"Persisted authorization state; token digests are intentionally omitted.","href":"documents/internal-next/?selected=detail-sha256-e7478ae4e1bcb888c4e2581e11d9a1390525d3341102984f9d4869f796d014c0#detail-sha256-e7478ae4e1bcb888c4e2581e11d9a1390525d3341102984f9d4869f796d014c0","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"4c9316ff69ad96efdc72eb40345cfa3a15e5858b02d313c309baa5d65ead0596","projectionSHA256":"5172334b81043dddbaf244fd0921cbab5c49fb1e8671670fb9526bb11cce5745"},{"detailId":"detail-sha256-890fb9bd52420ee3f660fd87ba33af9b0e6c317a30300f0d8c0758806b845a3f","name":"authorization-snapshot-input","description":"Complete replacement snapshot; empty arrays intentionally mean default-deny.","href":"documents/internal-next/?selected=detail-sha256-890fb9bd52420ee3f660fd87ba33af9b0e6c317a30300f0d8c0758806b845a3f#detail-sha256-890fb9bd52420ee3f660fd87ba33af9b0e6c317a30300f0d8c0758806b845a3f","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"3a5f2274a29a479cc70fa7b57e5e2c109f6acb12e616ea6f0c175c6ae7b30d83","projectionSHA256":"3111d6961a91fc5d8508fba6fe4dd526ea0c546f7b20166359ea47b545e4c30d"},{"detailId":"detail-sha256-900f073b5beff99d214996e2cf1f609e0da408b0abd64b66adfc42ec5477d6bf","name":"encryption-rotation-result","description":"Bounded root-key rewrap result. It contains counts and a keyset checkpoint only; no key material or secret data is returned.","href":"documents/internal-next/?selected=detail-sha256-900f073b5beff99d214996e2cf1f609e0da408b0abd64b66adfc42ec5477d6bf#detail-sha256-900f073b5beff99d214996e2cf1f609e0da408b0abd64b66adfc42ec5477d6bf","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"9dd93c16f661863b19eef3cf370b48d6ec8be2563a97c84bf55b6500356316ef","projectionSHA256":"d9a267a339dd1ffaf090d7e7aa5766b1c7469bc488532f4877239e83d4a556a1"},{"detailId":"detail-sha256-75b7f07b03c70e82e0b21bb7fa30a0cd55d466b842f5da2fff2b42d296654e08","name":"encryption-rotation-status","description":"Current shared root-key rotation state. Counts are point-in-time diagnostics, not a lock or a snapshot; no key material is returned.","href":"documents/internal-next/?selected=detail-sha256-75b7f07b03c70e82e0b21bb7fa30a0cd55d466b842f5da2fff2b42d296654e08#detail-sha256-75b7f07b03c70e82e0b21bb7fa30a0cd55d466b842f5da2fff2b42d296654e08","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"9aa8be3c57a88639c8add3d54490c78f94eebadfc5a73ef6c80b78165deb2e2a","projectionSHA256":"22eb666c1aa5790c2e1467e4b5b096d9d2687d44ad4671927ea3da04711fcaba"},{"detailId":"detail-sha256-4a301d87bf921d9a7cebbfa51be5487d0a8a9d4fc50b95090c6af7c0e602d2d7","name":"health-status","description":"Minimal probe result with no deployment details.","href":"documents/internal-next/?selected=detail-sha256-4a301d87bf921d9a7cebbfa51be5487d0a8a9d4fc50b95090c6af7c0e602d2d7#detail-sha256-4a301d87bf921d9a7cebbfa51be5487d0a8a9d4fc50b95090c6af7c0e602d2d7","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"a54e4ee9450bd7255ca45174b7e4b9157553707e1ea7023793a60e7dff904656","projectionSHA256":"a3a15a6aab456c24280ceab0b8cd848ce398b5e256cc673382f76666db502cdb"},{"detailId":"detail-sha256-683bbd54737d5342717f7112799aa3ea280c25bd213be98e1f226857c411b8b8","name":"problem","description":"Problem Details response compatible with RFC 9457.","href":"documents/internal-next/?selected=detail-sha256-683bbd54737d5342717f7112799aa3ea280c25bd213be98e1f226857c411b8b8#detail-sha256-683bbd54737d5342717f7112799aa3ea280c25bd213be98e1f226857c411b8b8","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"493b3a767d41e892ba1b859b1b5556502593eb5de66d4a170561a0246ffeb204","projectionSHA256":"607c36c5d0ea5bf9b34ff74a4965436ad5dfcd8ac4bd43f5472115f8f5f3ad27"},{"detailId":"detail-sha256-c47c927f4874895b7c5b99e45f395a3808e4791071de8d4ef2b4240907dbff4b","name":"problem-error","description":"Field-specific validation failure safe to expose to clients.","href":"documents/internal-next/?selected=detail-sha256-c47c927f4874895b7c5b99e45f395a3808e4791071de8d4ef2b4240907dbff4b#detail-sha256-c47c927f4874895b7c5b99e45f395a3808e4791071de8d4ef2b4240907dbff4b","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"2c480456a51780e46f9b799a861f7e1e9a0d86f8a27d2c042547e98059c4d197","projectionSHA256":"ad21bfff93537b1d1f9deb7bb953db3c452da7d27ec3bb9f3e15c03841987e2a"},{"detailId":"detail-sha256-53c004916e3b99447b94a5decdc431082d06ee249c3358e8a0288c74e860fed0","name":"unavailable-status","description":"Minimal readiness failure with no dependency details.","href":"documents/internal-next/?selected=detail-sha256-53c004916e3b99447b94a5decdc431082d06ee249c3358e8a0288c74e860fed0#detail-sha256-53c004916e3b99447b94a5decdc431082d06ee249c3358e8a0288c74e860fed0","detailChild":"details/internal-next/3e333812d00965dc2565ff4b240f8f093d2ec741c25a77030962e84014157abb.json","canonicalSHA256":"f2e76e4969170c137ea4098e8df7e6ef8ad341825aadbe506a58b5b6b558e88d","projectionSHA256":"500be7ca7a74ba76fc9a437c833620a94af40310c489948359c18414aea13d30"}],"securitySchemes":[{"name":"bearerAuth","anchor":"security-scheme-c41694373770a9cd","type":"http","description":"Deployment-issued bearer credential for restricted operations.","scheme":"bearer"}]},{"publication":{"api":"public","audience":"public","channel":"branch","repositoryURL":"https://github.com/araihu/moco","ref":"refs/heads/main","commit":"d07ca7a9f2690ffc75e8a6ebf6aaea574daea6f4","sourcePath":"openapi/public.yaml"},"key":"public-next","sourcePath":"public-next.json","title":"Mocó Public API","apiVersion":"0.2.0","branding":{"displayName":"","logoSrc":"","logoAlt":"","logoHomeHref":"","faviconHref":""},"overview":{"anchor":"overview","href":"?selected=overview#overview","headingId":"overview-heading","heading":"Mocó Public API","headingLevel":2,"description":"Tenant-isolated, path-based secret management for interactive and\nautomated clients. The contract makes no network-topology assumptions:\nclients can run inside or outside the Mocó Kubernetes cluster.\n","termsOfService":"","specDownloadFilename":"public-next.json","contact":{"name":"AraiHu","url":"https://github.com/araihu/moco","email":""},"license":{"name":"","url":"","identifier":""},"servers":[{"ordinal":0,"id":"server-0ed6a4449f076ffab47ae3a3e5ab027725d2fc310ec7eac41f75457052b219b0","url":"/","description":"Current deployment origin. Production deployments use TLS.","variables":[]}]},"sourceChild":"sources/public-next.json","schemaNodeShards":[{"path":"schema-nodes/public-next/82705e5e92420466c0d4b205b453222b92a883207175cf383b05257f7143fe3a.json","firstOrdinal":0,"lastOrdinal":97,"records":98,"length":72592,"sha256":"82705e5e92420466c0d4b205b453222b92a883207175cf383b05257f7143fe3a"}],"operations":[{"detailId":"detail-sha256-bb32f48fd6277369a5199b054873220827984698aced8eb6d7be38dbfa9c2ec8","operationId":"getServiceInfo","method":"GET","path":"/api/v1","title":"Get API compatibility information","description":"Returns server and API versions plus stable capability identifiers.","href":"documents/public-next/?selected=detail-sha256-bb32f48fd6277369a5199b054873220827984698aced8eb6d7be38dbfa9c2ec8#detail-sha256-bb32f48fd6277369a5199b054873220827984698aced8eb6d7be38dbfa9c2ec8","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Service"],"facets":[]},{"detailId":"detail-sha256-a8b1ac1a68bccbbcd30fd3fee1966c3f8b4d417452b832d47af7a4db1683570b","operationId":"listTenants","method":"GET","path":"/api/v1/tenants","title":"List tenants","description":"Lists tenants in the caller's collection authorization scope. The first\nrequest creates a sequence-bounded snapshot; follow `nextCursor` until\n`hasMore` is false. If a cursor expires, restart without one. Name and\nexternalId filters are exact and may be combined. For deterministic\nadoption, controllers should use an exact immutable `externalId` filter\nbefore creating a tenant.\n","href":"documents/public-next/?selected=detail-sha256-a8b1ac1a68bccbbcd30fd3fee1966c3f8b4d417452b832d47af7a4db1683570b#detail-sha256-a8b1ac1a68bccbbcd30fd3fee1966c3f8b4d417452b832d47af7a4db1683570b","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-9d369bd8f4f24022b2ab66ad75fd0457bad025fb4d3580b60e9ebc93285edd0b","operationId":"createTenant","method":"POST","path":"/api/v1/tenants","title":"Create a tenant","description":"Creates a tenant. Name and externalId are independently unique. Automation\nshould supply an externalId and Idempotency-Key. A uniqueness conflict\nreturns the existing resourceId when safe, allowing an atomic adoption\nhandshake. Repeating an identical request with the same Idempotency-Key\nreturns the original result; reusing that key with another body returns 409.\n","href":"documents/public-next/?selected=detail-sha256-9d369bd8f4f24022b2ab66ad75fd0457bad025fb4d3580b60e9ebc93285edd0b#detail-sha256-9d369bd8f4f24022b2ab66ad75fd0457bad025fb4d3580b60e9ebc93285edd0b","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-32d5910a07347dfe9ae54155081062bd1f0ff084b3bbfd668ed7899128294a6e","operationId":"deleteTenant","method":"DELETE","path":"/api/v1/tenants/{tenantId}","title":"Delete a tenant","description":"Deletes an empty tenant. With cascade=true, also deletes all child vaults\nand secrets. A missing tenant returns 404; reconcilers may treat it as\nsuccess. If-Match is optional, but recommended for retries that must not\ndelete a newer revision.\n","href":"documents/public-next/?selected=detail-sha256-32d5910a07347dfe9ae54155081062bd1f0ff084b3bbfd668ed7899128294a6e#detail-sha256-32d5910a07347dfe9ae54155081062bd1f0ff084b3bbfd668ed7899128294a6e","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-508a92baad838b9e40fed6866c17bd15a1d5e4fad0d121f5c0134fec92fc50fa","operationId":"getTenant","method":"GET","path":"/api/v1/tenants/{tenantId}","title":"Get a tenant","description":"Returns one tenant by its stable ID.","href":"documents/public-next/?selected=detail-sha256-508a92baad838b9e40fed6866c17bd15a1d5e4fad0d121f5c0134fec92fc50fa#detail-sha256-508a92baad838b9e40fed6866c17bd15a1d5e4fad0d121f5c0134fec92fc50fa","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-6cf6acbc4675a36a2a681f2b25f8356bc3436c53c23074e238a3baf06fbb8e52","operationId":"updateTenant","method":"PUT","path":"/api/v1/tenants/{tenantId}","title":"Update a tenant","description":"Replaces all mutable fields. externalId and server fields are immutable.\nIf-Match is optional; omit it only for an intentionally unconditional\nmutation. Retrying clients should read the representation and use its ETag.\n","href":"documents/public-next/?selected=detail-sha256-6cf6acbc4675a36a2a681f2b25f8356bc3436c53c23074e238a3baf06fbb8e52#detail-sha256-6cf6acbc4675a36a2a681f2b25f8356bc3436c53c23074e238a3baf06fbb8e52","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-a4f6cecaa02d56a795a3bd60fb2880d6d19b650de79a36af51ebc51922a0f28b","operationId":"listVaults","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults","title":"List vaults","description":"Lists vaults in the caller's tenant authorization scope. The first request\ncreates a sequence-bounded snapshot; follow `nextCursor` until `hasMore` is\nfalse. If a cursor expires, restart without one. Name and externalId filters\nare exact and may be combined. For deterministic adoption, controllers\nshould use an exact immutable `externalId` filter before creating a vault.\n","href":"documents/public-next/?selected=detail-sha256-a4f6cecaa02d56a795a3bd60fb2880d6d19b650de79a36af51ebc51922a0f28b#detail-sha256-a4f6cecaa02d56a795a3bd60fb2880d6d19b650de79a36af51ebc51922a0f28b","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-2ceb475f693b854127aec8611925b18598316e280257d96b9adb81c661cde2d8","operationId":"createVault","method":"POST","path":"/api/v1/tenants/{tenantId}/vaults","title":"Create a vault","description":"Creates a tenant-scoped vault. Name and externalId are independently unique\nwithin the tenant. Automation should supply an externalId and\nIdempotency-Key. A uniqueness conflict returns the existing resourceId when\nsafe, allowing an atomic adoption handshake. Repeating an identical request\nwith the same Idempotency-Key returns the original result.\n","href":"documents/public-next/?selected=detail-sha256-2ceb475f693b854127aec8611925b18598316e280257d96b9adb81c661cde2d8#detail-sha256-2ceb475f693b854127aec8611925b18598316e280257d96b9adb81c661cde2d8","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-8234113741f9ea11a923498f214529e3cdcedafde6521055eccb1a4c8be65fd3","operationId":"deleteVault","method":"DELETE","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Delete a vault","description":"Deletes an empty vault. With cascade=true, also deletes all stored secrets.\nA missing vault returns 404; reconcilers may treat it as success. If-Match\nis optional, but recommended for retries that must not delete a newer revision.\n","href":"documents/public-next/?selected=detail-sha256-8234113741f9ea11a923498f214529e3cdcedafde6521055eccb1a4c8be65fd3#detail-sha256-8234113741f9ea11a923498f214529e3cdcedafde6521055eccb1a4c8be65fd3","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-ca168ab3d95837a4768a2a4a6efda75b88f6d93b59aaee6abd79552b50f72646","operationId":"getVault","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Get a vault","description":"Returns one vault by stable tenant-scoped ID.","href":"documents/public-next/?selected=detail-sha256-ca168ab3d95837a4768a2a4a6efda75b88f6d93b59aaee6abd79552b50f72646#detail-sha256-ca168ab3d95837a4768a2a4a6efda75b88f6d93b59aaee6abd79552b50f72646","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-9627895a91a3970582dfb773406ba081d809065f77e08ae428e6a47cbc6f8286","operationId":"updateVault","method":"PUT","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Update a vault","description":"Replaces all mutable fields. externalId and server fields are immutable.\nIf-Match is optional; omit it only for an intentionally unconditional\nmutation. Retrying clients should read the representation and use its ETag.\n","href":"documents/public-next/?selected=detail-sha256-9627895a91a3970582dfb773406ba081d809065f77e08ae428e6a47cbc6f8286#detail-sha256-9627895a91a3970582dfb773406ba081d809065f77e08ae428e6a47cbc6f8286","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-6e4b9e4215744af434422a7019c15ff5063b6ce7774da3a69033ba3c3671c7f2","operationId":"deleteSecret","method":"DELETE","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Delete a secret","description":"Deletes the value at path. A missing secret returns 404; reconcilers may\ntreat that response as successful convergence.\n","href":"documents/public-next/?selected=detail-sha256-6e4b9e4215744af434422a7019c15ff5063b6ce7774da3a69033ba3c3671c7f2#detail-sha256-6e4b9e4215744af434422a7019c15ff5063b6ce7774da3a69033ba3c3671c7f2","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-c353055fe7a43c5840797390d247ac449b68337c1204b74f510ebce781c1aa9b","operationId":"getSecret","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Read a secret","description":"Returns one secret including its base64-encoded value. Clients must keep the\nresponse out of logs, status fields, events, metrics, traces, and caches.\nAuthorization is evaluated at vault granularity unless the deployment's\ninternal authorization policy sets `secretPathPrefix` for this route. When\npresent, the decoded logical `path` must begin with that literal prefix.\nUse a dedicated vault when a secret needs an independent policy scope.\n","href":"documents/public-next/?selected=detail-sha256-c353055fe7a43c5840797390d247ac449b68337c1204b74f510ebce781c1aa9b#detail-sha256-c353055fe7a43c5840797390d247ac449b68337c1204b74f510ebce781c1aa9b","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-7a8a7e89f9a7f76427dd44764afba0b3afb01b0eefd273b0a5e5ae699284a8be","operationId":"putSecret","method":"PUT","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Create or replace a secret","description":"Creates or replaces the value at path. `If-None-Match: *` makes the request\ncreate-only; `If-Match` makes it replace-only at a known ETag. Sending both\nheaders returns 400. Without either header the operation is an unconditional,\nidempotent upsert. The response contains metadata, never the submitted value.\nAuthorization remains vault-scoped for policies without a path prefix. A\ndeployment may narrow this operation with `secretPathPrefix` on its\ninternal authorization snapshot; the requested `path` must be within the\nconfigured prefix.\n","href":"documents/public-next/?selected=detail-sha256-7a8a7e89f9a7f76427dd44764afba0b3afb01b0eefd273b0a5e5ae699284a8be#detail-sha256-7a8a7e89f9a7f76427dd44764afba0b3afb01b0eefd273b0a5e5ae699284a8be","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-dc1f1e8541e9668101e291d17796490390cdb910285c5709140c10c610abd86a","operationId":"getSecretMetadata","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret/metadata","title":"Inspect secret state without reading its value","description":"Returns metadata only. Controllers should prefer this operation for drift\nchecks that do not require plaintext. When a deployment configures\n`secretPathPrefix`, the decoded `path` must begin with that literal prefix.\n","href":"documents/public-next/?selected=detail-sha256-dc1f1e8541e9668101e291d17796490390cdb910285c5709140c10c610abd86a#detail-sha256-dc1f1e8541e9668101e291d17796490390cdb910285c5709140c10c610abd86a","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-75c75858b9bda7c92b8cf33710b480b8d55dc704506ddba336ae44f2499c7f6d","operationId":"listSecrets","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secrets","title":"List secret metadata","description":"Lists metadata only; values are never returned. The first request creates a\nsequence-bounded snapshot. Follow `nextCursor` until `hasMore` is false. If\nthe cursor expires, restart without one. Omit `prefix` to list the complete\nvault only when the authorization policy is vault-scoped. A path-scoped\npolicy requires a non-empty `prefix` within its configured\n`secretPathPrefix`. Use `GET /api/v1/watch` as a full-resync signal after\nmutations, including deletions.\n","href":"documents/public-next/?selected=detail-sha256-75c75858b9bda7c92b8cf33710b480b8d55dc704506ddba336ae44f2499c7f6d#detail-sha256-75c75858b9bda7c92b8cf33710b480b8d55dc704506ddba336ae44f2499c7f6d","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-b7cc5e491da0db31d8ce62c3ad4cce6bca29fd7fdf16c11b6f616b5ec54a1d77","operationId":"watchTenantChanges","method":"GET","path":"/api/v1/tenants/{tenantId}/watch","title":"Wait for changes within one tenant","description":"Returns a durable resource checkpoint scoped to the tenant. With no\n`resourceVersion`, the endpoint returns the current checkpoint immediately.\nWith a checkpoint, it returns immediately when that checkpoint is stale or\nwaits up to `timeoutSeconds` for a newer tenant, vault, or secret mutation.\nA true `changed` result is only a signal to relist the collections the\ncaller is authorized to manage; this endpoint does not expose payloads,\nordering, or tombstones. The checkpoint survives tenant deletion as a\ntombstone, so a watcher that already knows the tenant can observe its final\nmutation. A tenant that has never existed returns 404.\n","href":"documents/public-next/?selected=detail-sha256-b7cc5e491da0db31d8ce62c3ad4cce6bca29fd7fdf16c11b6f616b5ec54a1d77#detail-sha256-b7cc5e491da0db31d8ce62c3ad4cce6bca29fd7fdf16c11b6f616b5ec54a1d77","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Service"],"facets":[]},{"detailId":"detail-sha256-9246e8e5bf2b18b1d3d23c7ccbf379e824cebae8edc89b391ca1fa7ca34c37f4","operationId":"watchChanges","method":"GET","path":"/api/v1/watch","title":"Wait for persisted resource changes","description":"Returns a durable, process-wide resource version. With no\n`resourceVersion`, the endpoint returns the current checkpoint immediately.\nWith a checkpoint, it returns immediately when the checkpoint is stale or\nwaits up to `timeoutSeconds` for a newer revision. A true `changed` result\nis a signal to resync the tenant, vault, and secret collections; this\nendpoint does not expose payloads, ordering, or tombstones. The checkpoint\nis process-wide, so this operation requires an explicit cluster-wide watch\npermission (`domain: \"*\"`); a tenant-scoped policy cannot authorize it.\nDeployments that need least privilege can use\n`GET /api/v1/tenants/{tenantId}/watch`, whose checkpoint is scoped to one\ntenant and accepts a literal tenant-domain policy.\n","href":"documents/public-next/?selected=detail-sha256-9246e8e5bf2b18b1d3d23c7ccbf379e824cebae8edc89b391ca1fa7ca34c37f4#detail-sha256-9246e8e5bf2b18b1d3d23c7ccbf379e824cebae8edc89b391ca1fa7ca34c37f4","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","deprecated":false,"tags":["Service"],"facets":[]}],"schemas":[{"detailId":"detail-sha256-0f2430583f9a201951c0393cdca789d676e59dc56da95608253f5ad5f2dcbb8f","name":"labels","description":"Client-defined metadata used for organization and ownership hints.","href":"documents/public-next/?selected=detail-sha256-0f2430583f9a201951c0393cdca789d676e59dc56da95608253f5ad5f2dcbb8f#detail-sha256-0f2430583f9a201951c0393cdca789d676e59dc56da95608253f5ad5f2dcbb8f","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"a74f53c89cd66731be5c4ec9c8b50deeb54079a419bf45e65237db85cc0f6f6b","projectionSHA256":"9f2853e987ad2b1f063c1302dfa12563ee284640946ecb642a565f618b25689e"},{"detailId":"detail-sha256-4b71076769f051462ed988da2d9e992650c9e6bbbe944f3f840c5279ecf588c3","name":"page-info","description":"Cursor state for one collection snapshot. Items are returned in ascending\nimmutable insertion-sequence order. If `hasMore` is true, `nextCursor` is\nnon-null and must be used to continue the same snapshot; if `hasMore` is\nfalse, `nextCursor` is null.\n","href":"documents/public-next/?selected=detail-sha256-4b71076769f051462ed988da2d9e992650c9e6bbbe944f3f840c5279ecf588c3#detail-sha256-4b71076769f051462ed988da2d9e992650c9e6bbbe944f3f840c5279ecf588c3","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"327461aacb7a77753679bd3c86669dd8e3dbdd01f142a829f80ea3cdaf2cbc49","projectionSHA256":"40d65d90c004c1e6931943c810e3556a51a2a1adfdeb75036beb422f438d4368"},{"detailId":"detail-sha256-62c48dca6948196bee9d43b820f8b0da5979feb81fb1f1b3563111623635dbe9","name":"problem","description":"Problem Details response compatible with RFC 9457.","href":"documents/public-next/?selected=detail-sha256-62c48dca6948196bee9d43b820f8b0da5979feb81fb1f1b3563111623635dbe9#detail-sha256-62c48dca6948196bee9d43b820f8b0da5979feb81fb1f1b3563111623635dbe9","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"493b3a767d41e892ba1b859b1b5556502593eb5de66d4a170561a0246ffeb204","projectionSHA256":"607c36c5d0ea5bf9b34ff74a4965436ad5dfcd8ac4bd43f5472115f8f5f3ad27"},{"detailId":"detail-sha256-93c0d462ca062c58f23752717b00436b90c60b39047e80d1788cac0c20f331c4","name":"problem-error","description":"Field-specific validation failure safe to expose to clients.","href":"documents/public-next/?selected=detail-sha256-93c0d462ca062c58f23752717b00436b90c60b39047e80d1788cac0c20f331c4#detail-sha256-93c0d462ca062c58f23752717b00436b90c60b39047e80d1788cac0c20f331c4","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"2c480456a51780e46f9b799a861f7e1e9a0d86f8a27d2c042547e98059c4d197","projectionSHA256":"ad21bfff93537b1d1f9deb7bb953db3c452da7d27ec3bb9f3e15c03841987e2a"},{"detailId":"detail-sha256-b7815cd3bff5456eb1ded7a52f4ae401b55e4afbf249f7d35f102706a78d8bea","name":"secret","description":"Secret metadata and value. Consumers must never log this object.","href":"documents/public-next/?selected=detail-sha256-b7815cd3bff5456eb1ded7a52f4ae401b55e4afbf249f7d35f102706a78d8bea#detail-sha256-b7815cd3bff5456eb1ded7a52f4ae401b55e4afbf249f7d35f102706a78d8bea","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"7747c6649f732f201d3c1ff0b5e5886fef0448faf28fd7acd1427a7acf708ad3","projectionSHA256":"bbdad589c1be309e683afb3a55a95875a5ca11340769e41bc4de307861075444"},{"detailId":"detail-sha256-c3da2fb21caf50aa3b50a64f6a8e1267be4bc9ba5f59907bea7ce6ba932c3e82","name":"secret-list","description":"One page of secret metadata ordered by immutable insertion sequence; values are omitted.","href":"documents/public-next/?selected=detail-sha256-c3da2fb21caf50aa3b50a64f6a8e1267be4bc9ba5f59907bea7ce6ba932c3e82#detail-sha256-c3da2fb21caf50aa3b50a64f6a8e1267be4bc9ba5f59907bea7ce6ba932c3e82","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"da4d30f4af797ebea14f28ced847cb4fa6f640c9b21658151297d57034ecd3d6","projectionSHA256":"2757be692c60646794dbf68ba0fc2854d090910231ede68ab1a4b8a3140574fa"},{"detailId":"detail-sha256-1caed7b9588f2f9e2c43ae63e9194c2f667742b755768b0108f33319a6cb0b64","name":"secret-metadata","description":"Secret identity and lifecycle metadata without its value.","href":"documents/public-next/?selected=detail-sha256-1caed7b9588f2f9e2c43ae63e9194c2f667742b755768b0108f33319a6cb0b64#detail-sha256-1caed7b9588f2f9e2c43ae63e9194c2f667742b755768b0108f33319a6cb0b64","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"077bc05d34185591a4b6a523bc402f82d0e3d6b64389e8ac965e197e6c9dd91d","projectionSHA256":"1ff032106604bf5cd1bedb77398d0566060a50e600af4f23bd677c91cf90d79c"},{"detailId":"detail-sha256-0282efccf91e14c1697c8b1567a6ddb3d57b865450cc562df32fd36ae5489f28","name":"secret-write","description":"Secret value and media type accepted for storage.","href":"documents/public-next/?selected=detail-sha256-0282efccf91e14c1697c8b1567a6ddb3d57b865450cc562df32fd36ae5489f28#detail-sha256-0282efccf91e14c1697c8b1567a6ddb3d57b865450cc562df32fd36ae5489f28","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"d64dc03f5ebede1a2ec5d63fbb14fbf8fe0c3f57068dc2179c7e98acb4f082dc","projectionSHA256":"fa44fea84a196c5868811704653ae89157e6bcaabad38476c43a9800c84b7cf3"},{"detailId":"detail-sha256-e61aa83ea6d53852d6031ae162ba0e6ba4a434f04f5a2191e30501cefeee50c3","name":"service-info","description":"Server identity and compatibility information.","href":"documents/public-next/?selected=detail-sha256-e61aa83ea6d53852d6031ae162ba0e6ba4a434f04f5a2191e30501cefeee50c3#detail-sha256-e61aa83ea6d53852d6031ae162ba0e6ba4a434f04f5a2191e30501cefeee50c3","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"6a3249d27ba3c91788ef90ea9b5acd83488724a110a5a4da988798d2132f7782","projectionSHA256":"e3fc5b90d701878bd43a66178f0a3680ee6d051a4dc49ebac5a8eaa898dd508d"},{"detailId":"detail-sha256-e9d365c1aa91d75eaa630586afcac23b19a6d19abe7f11971e27838963188570","name":"tenant","description":"Tenant identity, automation metadata, and lifecycle state.","href":"documents/public-next/?selected=detail-sha256-e9d365c1aa91d75eaa630586afcac23b19a6d19abe7f11971e27838963188570#detail-sha256-e9d365c1aa91d75eaa630586afcac23b19a6d19abe7f11971e27838963188570","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"7b4f81074c5b6cbde1eb32160095e287de38aaf3e34365bdfcd49b2db0c0b7ae","projectionSHA256":"0eeaab918ddf7fb380954dfc2352554ee52b24fa9cc6c4969041a3ae5316752e"},{"detailId":"detail-sha256-4c2a770a264db8e2031ec018b289df6a06d810460a4fe5ef9c856ea018b4630d","name":"tenant-create","description":"Fields accepted when creating a tenant.","href":"documents/public-next/?selected=detail-sha256-4c2a770a264db8e2031ec018b289df6a06d810460a4fe5ef9c856ea018b4630d#detail-sha256-4c2a770a264db8e2031ec018b289df6a06d810460a4fe5ef9c856ea018b4630d","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"1f4e438b6ad6025b745cbdf3806869d959c3a23a9f031471d3dac98763766242","projectionSHA256":"372be2453e49fda0d9a3d6f487406fc5017256193e3d3ffd85e49de47e3101a0"},{"detailId":"detail-sha256-f81ab149a480da19c3ea762fde17a285bf969554d2bd0d4a991d76d9da9703fb","name":"tenant-list","description":"One page from a stable tenant snapshot.","href":"documents/public-next/?selected=detail-sha256-f81ab149a480da19c3ea762fde17a285bf969554d2bd0d4a991d76d9da9703fb#detail-sha256-f81ab149a480da19c3ea762fde17a285bf969554d2bd0d4a991d76d9da9703fb","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"ad7eac9a84c86705a21129827a58cdde0360bfe30196f10150c24a597e050d9f","projectionSHA256":"e405d836dde55d15bc3766d62406a1ec86d6cba53376b9a7b132568b2851f720"},{"detailId":"detail-sha256-79b721152c36bf63421398bcf4343b48ae2b2306ede9bb492e05150c3fde3d7c","name":"tenant-resource-version","description":"Opaque durable resource checkpoint scoped to one tenant.","href":"documents/public-next/?selected=detail-sha256-79b721152c36bf63421398bcf4343b48ae2b2306ede9bb492e05150c3fde3d7c#detail-sha256-79b721152c36bf63421398bcf4343b48ae2b2306ede9bb492e05150c3fde3d7c","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"1079638f47e26e44519c67db049e5d07fd155b1e1117a714e9811b73ea5a7ab6","projectionSHA256":"b1974b18c902a28e5c525556dbb149638be19527448d50f2693ab89b4a8d81d0"},{"detailId":"detail-sha256-e2732952ae22d07894b847e7dc0a58f9007a65789661e478e94949daf6bf4e9d","name":"tenant-update","description":"Complete mutable tenant state used for replacement updates.","href":"documents/public-next/?selected=detail-sha256-e2732952ae22d07894b847e7dc0a58f9007a65789661e478e94949daf6bf4e9d#detail-sha256-e2732952ae22d07894b847e7dc0a58f9007a65789661e478e94949daf6bf4e9d","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"7134a804fcbe117dab17a9de688036731384869bae11327aea8dca943df3066c","projectionSHA256":"beed261dd7c1f8ff7faeef4960d66e40f83e1d26d0041dcf15530c2a4efdd815"},{"detailId":"detail-sha256-7ea5b30a0e38f1ba72a44aa255f2dbe6ffb4161178477d831cae68af32e5e383","name":"tenant-watch-result","description":"Durable tenant-scoped resource-version checkpoint returned by a watch poll.","href":"documents/public-next/?selected=detail-sha256-7ea5b30a0e38f1ba72a44aa255f2dbe6ffb4161178477d831cae68af32e5e383#detail-sha256-7ea5b30a0e38f1ba72a44aa255f2dbe6ffb4161178477d831cae68af32e5e383","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"f7ae6c51d4c5c23be998c4b005f4aa57111be904ef37cdaf98c06d5f860d662c","projectionSHA256":"2a9f6aa7f586126398a8406c8df9481c6344b81b46ee55801a385b434b02f81e"},{"detailId":"detail-sha256-20cf684ba1aae580171d57464fab0aa5b08b6527419b00cfc6715433847b3f17","name":"vault","description":"Tenant-scoped vault identity, automation metadata, and lifecycle state.","href":"documents/public-next/?selected=detail-sha256-20cf684ba1aae580171d57464fab0aa5b08b6527419b00cfc6715433847b3f17#detail-sha256-20cf684ba1aae580171d57464fab0aa5b08b6527419b00cfc6715433847b3f17","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"0809748382cce2c7f2c336240062c60687fbff1d7413c3bdbd82cc78d9ca1ff5","projectionSHA256":"930e52b081bed3d229ae0da3fb6185c5e444c46fd8064acf4bcfd891458917e9"},{"detailId":"detail-sha256-297f81d14af38de5673ed3ff819765ceb678d23a9e75615f55269083165e5964","name":"vault-create","description":"Fields accepted when creating a vault.","href":"documents/public-next/?selected=detail-sha256-297f81d14af38de5673ed3ff819765ceb678d23a9e75615f55269083165e5964#detail-sha256-297f81d14af38de5673ed3ff819765ceb678d23a9e75615f55269083165e5964","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"c5c30ea809b0a89f630ffee9e6294daf0c304ffb0a6d49700eb71897200526db","projectionSHA256":"4a33072381348a5b7bf9268d4de4f0ef6f62fa057a6377036ce6a1ac532b18ef"},{"detailId":"detail-sha256-eb507839c57041b92f01d8b7942b77555daf9f2d80ea6f81d61d5a007dea1918","name":"vault-list","description":"One page from a stable vault snapshot.","href":"documents/public-next/?selected=detail-sha256-eb507839c57041b92f01d8b7942b77555daf9f2d80ea6f81d61d5a007dea1918#detail-sha256-eb507839c57041b92f01d8b7942b77555daf9f2d80ea6f81d61d5a007dea1918","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"8b7dd92083589d21678e1bc3974e9e3eaa9a7ebf16daa28d0a826295a92faae7","projectionSHA256":"2af506815f6f81b630bad9ef53b21fc38d2dcf03727c92b0c37656e560fff0b6"},{"detailId":"detail-sha256-d9847cab1003c32df027182d46496cbe1d8da3c25032bbe8404f566455a578ea","name":"vault-update","description":"Complete mutable vault state used for replacement updates.","href":"documents/public-next/?selected=detail-sha256-d9847cab1003c32df027182d46496cbe1d8da3c25032bbe8404f566455a578ea#detail-sha256-d9847cab1003c32df027182d46496cbe1d8da3c25032bbe8404f566455a578ea","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"c992551997b653ac7fcabe77951b586dda9a38551f7f365c8d551c63a47f53d6","projectionSHA256":"9442ab9485486e0f72cacd2b3616c41b0e99d5c36ea7a501787528036928071b"},{"detailId":"detail-sha256-0a35c65faff429e6be713d31441c41a2bc6ac4b97beb0bd92f75fc95017d2300","name":"watch-result","description":"Durable resource-version checkpoint returned by a watch poll.","href":"documents/public-next/?selected=detail-sha256-0a35c65faff429e6be713d31441c41a2bc6ac4b97beb0bd92f75fc95017d2300#detail-sha256-0a35c65faff429e6be713d31441c41a2bc6ac4b97beb0bd92f75fc95017d2300","detailChild":"details/public-next/50392a6f65c161a6b469283b6f9e7b78e3d17ee38b8d1dce5760729de2a213dc.json","canonicalSHA256":"cb5b3145055b34158899bf5c728b988e1e18cfe029e64a44c892ec1571336a0e","projectionSHA256":"14ed744ae2c7b6f20bdebf48976582c993e456fae9754bfa0a2cee0e5b8d4e06"}],"securitySchemes":[{"name":"bearerAuth","anchor":"security-scheme-c41694373770a9cd","type":"http","description":"Deployment-issued bearer credential sent in the Authorization header.\nTokens may be opaque; clients must not assume JWT structure.\n","scheme":"bearer"}]}]}