{"openapi":"3.1.0","info":{"title":"Reoclo API","description":"The public HTTP API for the Reoclo platform (https://reoclo.com).\n\n## Surfaces\n\n- **Automation API** (`/api/automation/v1/`): versioned endpoints for CI/CD\n  and unattended jobs. Authenticate with an automation key (`rca_` prefix)\n  in the `Authorization: Bearer` header. Keys are scoped to named operations\n  and servers; create them in the dashboard under **Automation Keys**.\n- **OAuth 2.0**: authorization code with PKCE, and the device flow for CLIs.\n  Discovery documents: `/.well-known/oauth-authorization-server` and\n  `/.well-known/oauth-protected-resource` (RFC 9728, lists the scopes).\n- **Webhooks and public pages**: GitHub and Gitea webhook receivers, public\n  status pages, and account flows used by the dashboard.\n\n## Versioning and deprecation\n\n- Machine-facing endpoints are versioned in the URL path\n  (`/api/automation/v1/`). A breaking change ships as a new path version and\n  the old version keeps working through its deprecation window.\n- Unversioned endpoints (webhooks, OAuth, well-known documents) change only\n  in backward-compatible ways.\n- Before an endpoint is removed, responses carry `Deprecation` and `Sunset`\n  headers (RFC 8594) for at least 90 days, and the change is announced at\n  https://docs.reoclo.com/api/versioning/.\n- Every response carries an `X-API-Version` header with the deployed\n  version (1.203.0 for this document).\n\n## Rate limits\n\nResponses carry `RateLimit` and `RateLimit-Policy` fields\n(draft-ietf-httpapi-ratelimit-headers) next to the legacy `X-RateLimit-*`\nset. A `429` response carries `Retry-After`; wait that many seconds before\nthe next request. The default limit is 240 requests per minute per client\nIP. Stricter limits apply to account flows.\n\nFull documentation: https://docs.reoclo.com/api/overview/\n","version":"1.203.0"},"paths":{"/health":{"get":{"summary":"Health Check","description":"Return service liveness with the running version and build metadata.","operationId":"health_check_health_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthCheck"}}}}}}},"/health/ready":{"get":{"summary":"Health Ready","description":"Dependency-aware readiness, exposed on the gateway.\n\nThe same check already exists on the internal app, but the internal app is not\npublicly routable: `api.reoclo.com` is served by THIS gateway, and the LB's path\nallowlist keeps `streams.reoclo.com` to `/health` exactly. So without this route\nthe readiness probe existed and was reachable by nobody — which is precisely the\nsilent-gap failure the external watchdog exists to eliminate.\n\nThe gateway already opens a Mongo connection in its lifespan and runs the same\nimage (so it carries the same RabbitMQ settings), so it can run the probes\nitself rather than proxying to the internal app — one less hop to fail.\n\nDistinct from `/health` above, which is a static liveness probe the LB depends\non and which must never gain dependencies. The body stays minimal and never\nnames the failing dependency: this endpoint is unauthenticated on purpose, so\nthat an external watchdog needs no credential to read it.","operationId":"health_ready_health_ready_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReadinessCheck"}}}}}}},"/public/access-requests/":{"post":{"tags":["public-access-requests"],"summary":"Submit Access Request","description":"Submit a request for platform access. The team reviews it and replies by email.","operationId":"submit_access_request_public_access_requests__post","responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestPublicRead"}}}}}}},"/public/email-change/validate":{"get":{"tags":["public-email-change"],"summary":"Validate Email Change","description":"Check whether an email-change token is valid and unexpired.","operationId":"validate_email_change_public_email_change_validate_get","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string","title":"Token"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailChangeValidateResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/public/email-change/confirm":{"post":{"tags":["public-email-change"],"summary":"Confirm Email Change Route","description":"Confirm an email change with the token sent to the new address.","operationId":"confirm_email_change_route_public_email_change_confirm_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailChangeMessageResponse"}}}}}}},"/public/password-reset/request":{"post":{"tags":["public-password-reset"],"summary":"Request Password Reset","description":"Start a password reset. The response is identical whether or not the email exists.","operationId":"request_password_reset_public_password_reset_request_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasswordResetMessageResponse"}}}}}}},"/public/password-reset/validate":{"get":{"tags":["public-password-reset"],"summary":"Validate Password Reset","description":"Check whether a password-reset token is valid and unexpired.","operationId":"validate_password_reset_public_password_reset_validate_get","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string","title":"Token"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasswordResetValidateResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/public/password-reset/confirm":{"post":{"tags":["public-password-reset"],"summary":"Confirm Password Reset","description":"Set a new password with a valid reset token.","operationId":"confirm_password_reset_public_password_reset_confirm_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasswordResetMessageResponse"}}}}}}},"/public/pilot-invite/validate":{"get":{"tags":["public-pilot-invite"],"summary":"Validate","description":"Check whether a pilot invite token is valid, used, or expired.","operationId":"validate_public_pilot_invite_validate_get","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string","title":"Token"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PilotInviteValidateResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/public/pilot-invite/resend":{"post":{"tags":["public-pilot-invite"],"summary":"Resend","description":"Send a fresh invite email for an expired or lost pilot invite token.","operationId":"resend_public_pilot_invite_resend_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PilotInviteResendResponse"}}}}}}},"/external-deploy/session":{"post":{"tags":["external-deploy"],"summary":"Create Deploy Session","description":"Exchange an `rca_*` key for a short-lived deploy session token.\n\nThe caller must supply the container names they intend to deploy. Only\ncontainer names that are linked to active Application records in the tenant\nare accepted; at least one match is required. Unrecognised names are\nreturned in `unmatched` for diagnostic purposes.","operationId":"create_deploy_session_external_deploy_session_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploySessionCreate"}}},"required":true},"responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploySessionCreateResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"HTTPBearer":[]}]}},"/external-deploy/sync":{"post":{"tags":["external-deploy"],"summary":"Sync Deploy","description":"Rewrite proxy_routes for externally-deployed containers.\n\nRequires a valid `rds_*` session token (minted by POST /external-deploy/session).\nFor each deployment item:\n- The container_name must be linked to an Application in the session's\n  allowed_application_ids.\n- Calls reconcile_application which computes a signature for dedup/conflict\n  detection, upserts proxy_routes, and triggers the Caddy reconciler.\n\nReturns 409 if ALL items are in conflict status. Otherwise 200 with mixed results.","operationId":"sync_deploy_external_deploy_sync_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploySyncRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploySyncResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"HTTPBearer":[]}]}},"/external-deploy/status":{"get":{"tags":["external-deploy"],"summary":"Deploy Status","description":"Report per-application managed-proxy convergence for the session's apps.\n\nRequires a valid `rds_*` deploy session token. Lets `reoclo deploy sync\n--wait` poll until each synced app is actually live (managed Caddy running,\nroutes applied, container attached to reoclo-proxy) rather than relying on\nthe asynchronous reconciler having caught up when the sync call returned.","operationId":"deploy_status_external_deploy_status_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeployStatusResponse"}}}}},"security":[{"HTTPBearer":[]}]}},"/external-deploy/session/{session_id}":{"delete":{"tags":["external-deploy"],"summary":"Revoke Deploy Session","description":"Revoke an active deploy session.\n\nAccepts either:\n- `rca_*` bearer token with `external_deploy` scope (revokes any session in tenant).\n- `rds_*` session token for self-revocation (may only revoke its own session).","operationId":"revoke_deploy_session_external_deploy_session__session_id__delete","security":[{"HTTPBearer":[]}],"parameters":[{"name":"session_id","in":"path","required":true,"schema":{"type":"string","format":"uuid","title":"Session Id"}}],"responses":{"204":{"description":"Successful Response"},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/webhooks/gitea/{provider_id}":{"post":{"tags":["webhooks"],"summary":"Gitea Webhook","description":"Receive and process Gitea webhook events.\n\nEach Gitea provider has its own webhook URL and secret. The provider_id\nin the path identifies which provider's secret to use for verification.","operationId":"gitea_webhook_webhooks_gitea__provider_id__post","parameters":[{"name":"provider_id","in":"path","required":true,"schema":{"type":"string","format":"uuid","title":"Provider Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StatusResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/webhooks/github":{"post":{"tags":["webhooks"],"summary":"Github Webhook","description":"Receive GitHub App webhook events. Requires a valid X-Hub-Signature-256.","operationId":"github_webhook_webhooks_github_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StatusResponse"}}}}}}},"/oauth/authorize":{"get":{"tags":["oauth"],"summary":"Authorize Get","description":"Validate PKCE authorize request.\n\n- If no session cookie: redirect to /login?next=<this URL>.\n- If session present: return 200 JSON context for the Astro consent UI (1E-2).","operationId":"authorize_get_oauth_authorize_get","parameters":[{"name":"client_id","in":"query","required":true,"schema":{"type":"string","title":"Client Id"}},{"name":"response_type","in":"query","required":true,"schema":{"type":"string","title":"Response Type"}},{"name":"code_challenge","in":"query","required":true,"schema":{"type":"string","title":"Code Challenge"}},{"name":"code_challenge_method","in":"query","required":true,"schema":{"type":"string","title":"Code Challenge Method"}},{"name":"redirect_uri","in":"query","required":true,"schema":{"type":"string","title":"Redirect Uri"}},{"name":"state","in":"query","required":true,"schema":{"type":"string","title":"State"}},{"name":"scope","in":"query","required":false,"schema":{"type":"string","default":"","title":"Scope"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"title":"Response Authorize Get Oauth Authorize Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/oauth/token":{"post":{"tags":["oauth"],"summary":"Token Endpoint","description":"Handle authorization_code, refresh_token, device_code, and tenant_switch grants.","operationId":"token_endpoint_oauth_token_post","requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/Body_token_endpoint_oauth_token_post"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/oauth/device":{"post":{"tags":["oauth"],"summary":"Device Init","description":"Device Authorization Grant — init (RFC 8628 §3.2).\n\nPer RFC 8628 §3.1 the body is `application/x-www-form-urlencoded`,\nmatching `/oauth/token`. Earlier versions of this handler took a\nJSON Pydantic body, which broke standards-compliant clients.\n\nNo feature flag gates this endpoint — it issues only a short-lived\ndevice_code/user_code pair, no tokens.","operationId":"device_init_oauth_device_post","requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/Body_device_init_oauth_device_post"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeviceInitResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/oauth/revoke":{"post":{"tags":["oauth"],"summary":"Revoke Token","description":"Revoke an access or refresh token (RFC 7009 §2.1).\n\nPer RFC 7009 §2.2, always returns 200 OK even if the token is unknown.","operationId":"revoke_token_oauth_revoke_post","requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/Body_revoke_token_oauth_revoke_post"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Revoke Token Oauth Revoke Post"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"HTTPBearer":[]}]}},"/oauth/userinfo":{"get":{"tags":["oauth"],"summary":"Userinfo","description":"OIDC userinfo endpoint — returns standard claims from the JWT payload.","operationId":"userinfo_oauth_userinfo_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Userinfo Oauth Userinfo Get"}}}}},"security":[{"HTTPBearer":[]}]}},"/oauth/register":{"post":{"tags":["oauth"],"summary":"Register Client","description":"Register a public OAuth client (RFC 7591).\n\nAccepts browser and native MCP clients. The registered client is a\npublic client: PKCE is required, and no client secret is issued.\nRegistrations are rate limited and can be revoked by an administrator.","operationId":"register_client_oauth_register_post","responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientRegistrationResponse"}}}}}}},"/s/{slug}":{"get":{"tags":["public-status-html"],"summary":"Get Public Status Page Html","description":"Render the public status page for a slug as a standalone HTML document.","operationId":"get_public_status_page_html_s__slug__get","parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string","title":"Slug"}}],"responses":{"200":{"description":"Successful Response","content":{"text/html":{"schema":{"type":"string"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/public/status/{slug}":{"get":{"tags":["public-status"],"summary":"Get Public Status Page","description":"Return the public status page for a slug as JSON: components, incidents, uptime.","operationId":"get_public_status_page_public_status__slug__get","parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string","title":"Slug"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicStatusRead"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/verify-domain":{"get":{"tags":["domain-verification"],"summary":"Verify Domain","description":"Validate a domain for on-demand TLS certificate provisioning.\n\nReturns 200 if the domain has an active StatusPageHost record linked\nto a published status page under a verified domain. Returns 404 otherwise.\nCaddy's on_demand_tls `ask` protocol interprets 200 as \"issue cert\".","operationId":"verify_domain_verify_domain_get","parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string","minLength":3,"maxLength":253,"title":"Domain"}}],"responses":{"200":{"description":"Domain is verified; Caddy may issue a certificate."},"403":{"description":"Caller is not the external Caddy load balancer."},"404":{"description":"Domain is unknown or not verified."},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/.well-known/jwks.json":{"get":{"tags":["well-known"],"summary":"Get Jwks","description":"Return the JSON Web Key Set used to verify Reoclo-issued tokens.","operationId":"get_jwks__well_known_jwks_json_get","responses":{"200":{"description":"Metadata document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/oauth-authorization-server":{"get":{"tags":["well-known"],"summary":"Get Oauth Authorization Server","description":"Return OAuth 2.0 authorization server metadata (RFC 8414).","operationId":"get_oauth_authorization_server__well_known_oauth_authorization_server_get","responses":{"200":{"description":"Metadata document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/openid-configuration":{"get":{"tags":["well-known"],"summary":"Get Openid Configuration","description":"Return OpenID Connect discovery metadata (alias of the OAuth document).","operationId":"get_openid_configuration__well_known_openid_configuration_get","responses":{"200":{"description":"Metadata document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/oauth-protected-resource":{"get":{"tags":["well-known"],"summary":"Get Oauth Protected Resource","description":"Return OAuth protected resource metadata (RFC 9728).\n\nLists the authorization server, the supported scopes, and where tokens\ngo (the Authorization header), so agents can request least-privilege\naccess without reading the human documentation.","operationId":"get_oauth_protected_resource__well_known_oauth_protected_resource_get","responses":{"200":{"description":"Metadata document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/automation/v1/exec":{"post":{"tags":["automation"],"summary":"Automation Exec","description":"Run a shell command on a server. Requires the `exec` operation grant for that server.","operationId":"automation_exec_api_automation_v1_exec_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationExecRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationExecResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/deploy":{"post":{"tags":["automation"],"summary":"Automation Deploy","description":"Queue a deployment for an application. Requires the `deploy` operation grant. Returns 202 with an operation id to poll.","operationId":"automation_deploy_api_automation_v1_deploy_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationDeployRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationDeployResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/restart":{"post":{"tags":["automation"],"summary":"Automation Restart","description":"Restart a container on a server. Requires the `restart` operation grant.","operationId":"automation_restart_api_automation_v1_restart_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRestartRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationOperationResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/reboot":{"post":{"tags":["automation"],"summary":"Automation Reboot","description":"Queue a server reboot. Requires the `reboot` operation grant. Returns 202 with an operation id to poll.","operationId":"automation_reboot_api_automation_v1_reboot_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRebootRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationOperationResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/registry-auth/login":{"post":{"tags":["automation"],"summary":"Automation Registry Login","description":"Log a server's Docker daemon into a registry with a stored credential. Requires the `registry_auth` operation grant.","operationId":"automation_registry_login_api_automation_v1_registry_auth_login_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRegistryLoginRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRegistryLoginResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/registry-auth/login-direct":{"post":{"tags":["automation"],"summary":"Automation Registry Login Direct","description":"Log a server's Docker daemon into a registry with credentials supplied in the request. Requires the `registry_auth` operation grant.","operationId":"automation_registry_login_direct_api_automation_v1_registry_auth_login_direct_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRegistryLoginDirectRequest"}}},"required":true},"responses":{"202":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRegistryLoginResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/registry-auth/logout":{"post":{"tags":["automation"],"summary":"Automation Registry Logout","description":"Log a server's Docker daemon out of a registry. Requires the `registry_auth` operation grant.","operationId":"automation_registry_logout_api_automation_v1_registry_auth_logout_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationRegistryLogoutRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationOperationResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/operations/{operation_id}":{"get":{"tags":["automation"],"summary":"Get Automation Operation","description":"Return the status and result of a queued automation operation.","operationId":"get_automation_operation_api_automation_v1_operations__operation_id__get","security":[{"AutomationKey":[]}],"parameters":[{"name":"operation_id","in":"path","required":true,"schema":{"type":"string","format":"uuid","title":"Operation Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationOperationDetail"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/automation/v1/secrets/open-session":{"post":{"tags":["secrets-machine"],"summary":"Open Session","description":"Open a short-lived secrets session for a machine principal. Returns a session token for resolve calls.","operationId":"open_session_api_automation_v1_secrets_open_session_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OpenSessionRequest"}}},"required":true},"responses":{"201":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OpenSessionResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/secrets/resolve":{"post":{"tags":["secrets-machine"],"summary":"Resolve","description":"Resolve secret values for granted projects inside an open session. Access is audited.","operationId":"resolve_api_automation_v1_secrets_resolve_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"AutomationKey":[]}]}},"/api/automation/v1/secrets/accessible-projects":{"get":{"tags":["secrets-machine"],"summary":"Accessible Projects","description":"List the secret projects the calling principal can read.","operationId":"accessible_projects_api_automation_v1_secrets_accessible_projects_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/AccessibleProjectRead"},"type":"array","title":"Response Accessible Projects Api Automation V1 Secrets Accessible Projects Get"}}}}},"security":[{"AutomationKey":[]}]}}},"components":{"schemas":{"AccessRequestPublicRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"name":{"type":"string","title":"Name"},"email":{"type":"string","title":"Email"},"company":{"type":"string","title":"Company"},"message":{"type":"string","title":"Message"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"created_at":{"type":"string","format":"date-time","title":"Created At"}},"type":"object","required":["id","name","email","company","message","status","created_at"],"title":"AccessRequestPublicRead","description":"Response schema for public POST — no admin_notes exposed."},"AccessRequestStatus":{"type":"string","enum":["pending","approved","denied"],"title":"AccessRequestStatus","description":"Lifecycle status for access requests."},"AffectedComponentSnapshot":{"properties":{"component_id":{"type":"string","title":"Component Id"},"name":{"type":"string","title":"Name"},"source_kind":{"type":"string","title":"Source Kind"},"source_ref_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Source Ref Id"},"source_ref_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Source Ref Name"}},"type":"object","required":["component_id","name","source_kind"],"title":"AffectedComponentSnapshot","description":"Point-in-time snapshot of a status component when an incident is created.\n\nStores enough metadata to identify the component even if it is later\ndeleted or renamed."},"AutoIncidentPolicy":{"properties":{"enabled":{"type":"boolean","title":"Enabled","default":true},"open_after_consecutive_failures":{"type":"integer","maximum":20.0,"minimum":1.0,"title":"Open After Consecutive Failures","default":3},"resolve_after_consecutive_successes":{"type":"integer","maximum":20.0,"minimum":1.0,"title":"Resolve After Consecutive Successes","default":2}},"type":"object","title":"AutoIncidentPolicy"},"Body_device_init_oauth_device_post":{"properties":{"client_id":{"type":"string","title":"Client Id"},"scope":{"type":"string","title":"Scope","default":""}},"type":"object","required":["client_id"],"title":"Body_device_init_oauth_device_post"},"Body_revoke_token_oauth_revoke_post":{"properties":{"token":{"type":"string","title":"Token"},"client_id":{"type":"string","title":"Client Id"}},"type":"object","required":["token","client_id"],"title":"Body_revoke_token_oauth_revoke_post"},"Body_token_endpoint_oauth_token_post":{"properties":{"grant_type":{"type":"string","title":"Grant Type"},"client_id":{"type":"string","title":"Client Id"},"code":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Code"},"code_verifier":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Code Verifier"},"redirect_uri":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Redirect Uri"},"refresh_token":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Refresh Token"},"device_code":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Device Code"},"tenant_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Tenant Id"},"current_access_token":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Current Access Token"}},"type":"object","required":["grant_type","client_id"],"title":"Body_token_endpoint_oauth_token_post"},"ClientRegistrationResponse":{"properties":{"client_id":{"type":"string","title":"Client Id"},"client_id_issued_at":{"type":"integer","title":"Client Id Issued At"},"redirect_uris":{"items":{"type":"string"},"type":"array","title":"Redirect Uris"},"client_name":{"type":"string","title":"Client Name"},"token_endpoint_auth_method":{"type":"string","title":"Token Endpoint Auth Method"},"grant_types":{"items":{"type":"string"},"type":"array","title":"Grant Types"},"response_types":{"items":{"type":"string"},"type":"array","title":"Response Types"},"scope":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scope"},"client_uri":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Client Uri"},"logo_uri":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Logo Uri"}},"type":"object","required":["client_id","client_id_issued_at","redirect_uris","client_name","token_endpoint_auth_method","grant_types","response_types"],"title":"ClientRegistrationResponse","description":"RFC 7591 §3.2.1 client information response (public client: no secret)."},"ComponentSourceKind":{"type":"string","enum":["domain","server","application","monitor","manual"],"title":"ComponentSourceKind"},"ComponentStatus":{"type":"string","enum":["operational","degraded_performance","partial_outage","major_outage","maintenance","unknown"],"title":"ComponentStatus"},"DeploySessionApplicationRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"linked_container_name":{"type":"string","title":"Linked Container Name"},"container_port":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Container Port"},"bound_fqdns":{"items":{"type":"string"},"type":"array","title":"Bound Fqdns"}},"type":"object","required":["id","linked_container_name","container_port","bound_fqdns"],"title":"DeploySessionApplicationRead"},"DeploySessionCreate":{"properties":{"container_names":{"items":{"type":"string"},"type":"array","maxItems":50,"title":"Container Names"},"application_refs":{"items":{"type":"string"},"type":"array","maxItems":50,"title":"Application Refs"},"workflow_run_id":{"anyOf":[{"type":"string","maxLength":120},{"type":"null"}],"title":"Workflow Run Id"},"commit_sha":{"anyOf":[{"type":"string","maxLength":80},{"type":"null"}],"title":"Commit Sha"}},"type":"object","title":"DeploySessionCreate"},"DeploySessionCreateResponse":{"properties":{"session_id":{"type":"string","format":"uuid","title":"Session Id"},"session_token":{"type":"string","title":"Session Token"},"expires_at":{"type":"string","format":"date-time","title":"Expires At"},"applications":{"items":{"$ref":"#/components/schemas/DeploySessionApplicationRead"},"type":"array","title":"Applications"},"unmatched":{"items":{"type":"string"},"type":"array","title":"Unmatched"}},"type":"object","required":["session_id","session_token","expires_at","applications","unmatched"],"title":"DeploySessionCreateResponse"},"DeployStatusItem":{"properties":{"application_id":{"type":"string","format":"uuid","title":"Application Id"},"container_name":{"type":"string","title":"Container Name"},"caddy_running":{"type":"boolean","title":"Caddy Running"},"route_in_sync":{"type":"boolean","title":"Route In Sync"},"attached":{"type":"boolean","title":"Attached"},"converged":{"type":"boolean","title":"Converged"},"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"}},"type":"object","required":["application_id","container_name","caddy_running","route_in_sync","attached","converged"],"title":"DeployStatusItem"},"DeployStatusResponse":{"properties":{"session_id":{"type":"string","format":"uuid","title":"Session Id"},"converged":{"type":"boolean","title":"Converged"},"applications":{"items":{"$ref":"#/components/schemas/DeployStatusItem"},"type":"array","title":"Applications"}},"type":"object","required":["session_id","converged","applications"],"title":"DeployStatusResponse"},"DeploySyncRequest":{"properties":{"deployments":{"items":{"$ref":"#/components/schemas/DeploySyncRequestItem"},"type":"array","maxItems":50,"minItems":1,"title":"Deployments"}},"type":"object","required":["deployments"],"title":"DeploySyncRequest"},"DeploySyncRequestItem":{"properties":{"container_name":{"type":"string","maxLength":200,"minLength":1,"title":"Container Name"},"application_ref":{"anyOf":[{"type":"string","maxLength":200},{"type":"null"}],"title":"Application Ref"},"container_port":{"type":"integer","maximum":65535.0,"exclusiveMinimum":0.0,"title":"Container Port"},"image_tag":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}],"title":"Image Tag"},"force":{"type":"boolean","title":"Force","default":false}},"type":"object","required":["container_name","container_port"],"title":"DeploySyncRequestItem"},"DeploySyncResponse":{"properties":{"session_id":{"type":"string","format":"uuid","title":"Session Id"},"results":{"items":{"$ref":"#/components/schemas/DeploySyncResponseItem"},"type":"array","title":"Results"},"errors":{"items":{"additionalProperties":{"type":"string"},"type":"object"},"type":"array","title":"Errors"}},"type":"object","required":["session_id","results"],"title":"DeploySyncResponse"},"DeploySyncResponseItem":{"properties":{"application_id":{"type":"string","format":"uuid","title":"Application Id"},"container_name":{"type":"string","title":"Container Name"},"status":{"type":"string","enum":["synced","noop","conflict","drift_recovered"],"title":"Status"},"signature_hash":{"type":"string","title":"Signature Hash"},"synced_fqdns":{"items":{"type":"string"},"type":"array","title":"Synced Fqdns"},"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"}},"type":"object","required":["application_id","container_name","status","signature_hash"],"title":"DeploySyncResponseItem"},"DeviceInitResponse":{"properties":{"device_code":{"type":"string","title":"Device Code"},"user_code":{"type":"string","title":"User Code"},"verification_uri":{"type":"string","title":"Verification Uri"},"verification_uri_complete":{"type":"string","title":"Verification Uri Complete"},"expires_in":{"type":"integer","title":"Expires In"},"interval":{"type":"integer","title":"Interval"}},"type":"object","required":["device_code","user_code","verification_uri","verification_uri_complete","expires_in","interval"],"title":"DeviceInitResponse"},"EmailChangeMessageResponse":{"properties":{"message":{"type":"string","title":"Message"},"email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Email"}},"type":"object","required":["message"],"title":"EmailChangeMessageResponse"},"EmailChangeValidateResponse":{"properties":{"valid":{"type":"boolean","title":"Valid"}},"type":"object","required":["valid"],"title":"EmailChangeValidateResponse"},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"HealthCheck":{"properties":{"status":{"type":"string","title":"Status"},"service":{"type":"string","title":"Service"},"version":{"type":"string","title":"Version"},"commit_sha":{"type":"string","title":"Commit Sha"},"build_date":{"type":"string","title":"Build Date"}},"type":"object","required":["status","service","version","commit_sha","build_date"],"title":"HealthCheck"},"HealthCheckConfig":{"properties":{"enabled":{"type":"boolean","title":"Enabled","default":false},"url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Url"},"interval_seconds":{"type":"integer","maximum":3600.0,"minimum":10.0,"title":"Interval Seconds","default":60},"expected_status_min":{"type":"integer","maximum":599.0,"minimum":100.0,"title":"Expected Status Min","default":200},"expected_status_max":{"type":"integer","maximum":599.0,"minimum":100.0,"title":"Expected Status Max","default":299},"timeout_seconds":{"type":"integer","maximum":60.0,"minimum":1.0,"title":"Timeout Seconds","default":10}},"type":"object","title":"HealthCheckConfig","description":"Optional HTTP health check configuration for a status component.\n\nWhen enabled, the scheduler will periodically poll the URL and use the\nresult to derive source_status. This works alongside source-based status\nderivation: if both a source (domain/server/app) and a health check are\nconfigured, the health check result takes priority as the more specific signal."},"IncidentRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"tenant_id":{"type":"string","format":"uuid","title":"Tenant Id"},"status_page_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}],"title":"Status Page Id"},"source":{"$ref":"#/components/schemas/IncidentSource"},"state":{"$ref":"#/components/schemas/IncidentState"},"severity":{"$ref":"#/components/schemas/IncidentSeverity"},"title":{"type":"string","title":"Title"},"summary":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Summary"},"affected_component_ids":{"items":{"type":"string"},"type":"array","title":"Affected Component Ids"},"affected_components_snapshot":{"items":{"$ref":"#/components/schemas/AffectedComponentSnapshot"},"type":"array","title":"Affected Components Snapshot"},"started_at":{"type":"string","format":"date-time","title":"Started At"},"resolved_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Resolved At"},"created_by_user_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Created By User Id"},"last_update_at":{"type":"string","format":"date-time","title":"Last Update At"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"updated_at":{"type":"string","format":"date-time","title":"Updated At"}},"type":"object","required":["id","tenant_id","status_page_id","source","state","severity","title","summary","affected_component_ids","affected_components_snapshot","started_at","resolved_at","created_by_user_id","last_update_at","created_at","updated_at"],"title":"IncidentRead"},"IncidentSeverity":{"type":"string","enum":["minor","major","critical"],"title":"IncidentSeverity"},"IncidentSource":{"type":"string","enum":["manual","auto","agent"],"title":"IncidentSource"},"IncidentState":{"type":"string","enum":["investigating","identified","monitoring","resolved"],"title":"IncidentState"},"PasswordResetMessageResponse":{"properties":{"message":{"type":"string","title":"Message"}},"type":"object","required":["message"],"title":"PasswordResetMessageResponse"},"PasswordResetValidateResponse":{"properties":{"valid":{"type":"boolean","title":"Valid"}},"type":"object","required":["valid"],"title":"PasswordResetValidateResponse"},"PilotInviteResendResponse":{"properties":{"requested":{"type":"boolean","title":"Requested"}},"type":"object","required":["requested"],"title":"PilotInviteResendResponse"},"PilotInviteValidateResponse":{"properties":{"status":{"type":"string","enum":["valid","used","expired","invalid"],"title":"Status"},"email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Email"}},"type":"object","required":["status"],"title":"PilotInviteValidateResponse"},"PublicStatusRead":{"properties":{"status_page":{"$ref":"#/components/schemas/StatusPageRead"},"components":{"items":{"$ref":"#/components/schemas/StatusComponentRead"},"type":"array","title":"Components"},"incidents":{"items":{"$ref":"#/components/schemas/IncidentRead"},"type":"array","title":"Incidents"}},"type":"object","required":["status_page","components","incidents"],"title":"PublicStatusRead"},"ReadinessCheck":{"properties":{"status":{"type":"string","enum":["ready","degraded"],"title":"Status"}},"type":"object","required":["status"],"title":"ReadinessCheck"},"StatusComponentOverride":{"properties":{"enabled":{"type":"boolean","title":"Enabled","default":false},"status":{"anyOf":[{"$ref":"#/components/schemas/ComponentStatus"},{"type":"null"}]},"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"},"suppress_auto_incidents":{"type":"boolean","title":"Suppress Auto Incidents","default":true},"until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Until"}},"type":"object","title":"StatusComponentOverride"},"StatusComponentRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"tenant_id":{"type":"string","format":"uuid","title":"Tenant Id"},"status_page_id":{"type":"string","format":"uuid","title":"Status Page Id"},"name":{"type":"string","title":"Name"},"position":{"type":"integer","title":"Position"},"is_visible":{"type":"boolean","title":"Is Visible"},"source":{"$ref":"#/components/schemas/StatusComponentSource"},"health_check":{"$ref":"#/components/schemas/HealthCheckConfig"},"override":{"$ref":"#/components/schemas/StatusComponentOverride"},"auto_incident":{"$ref":"#/components/schemas/AutoIncidentPolicy"},"state":{"$ref":"#/components/schemas/StatusComponentState"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"updated_at":{"type":"string","format":"date-time","title":"Updated At"}},"type":"object","required":["id","tenant_id","status_page_id","name","position","is_visible","source","health_check","override","auto_incident","state","created_at","updated_at"],"title":"StatusComponentRead"},"StatusComponentSource":{"properties":{"kind":{"$ref":"#/components/schemas/ComponentSourceKind"},"ref_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ref Id"}},"type":"object","required":["kind"],"title":"StatusComponentSource"},"StatusComponentState":{"properties":{"source_status":{"$ref":"#/components/schemas/ComponentStatus","default":"unknown"},"source_last_checked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Source Last Checked At"},"next_check_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Next Check At"},"effective_status":{"$ref":"#/components/schemas/ComponentStatus","default":"unknown"},"effective_changed_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Effective Changed At"},"consecutive_failures":{"type":"integer","title":"Consecutive Failures","default":0},"consecutive_successes":{"type":"integer","title":"Consecutive Successes","default":0},"down_started_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Down Started At"},"up_started_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Up Started At"},"source_missing":{"type":"boolean","title":"Source Missing","default":false},"active_auto_incident_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Active Auto Incident Id"}},"type":"object","title":"StatusComponentState"},"StatusPageBranding":{"properties":{"company_name":{"type":"string","maxLength":120,"title":"Company Name","default":""},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Logo Url"},"logo_upload_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Logo Upload Url"},"brand_color_hex":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Brand Color Hex"},"favicon_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Favicon Url"},"favicon_upload_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Favicon Upload Url"},"hide_company_name":{"type":"boolean","title":"Hide Company Name","default":false},"use_org_branding":{"type":"boolean","title":"Use Org Branding","default":false}},"type":"object","title":"StatusPageBranding"},"StatusPageRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"tenant_id":{"type":"string","format":"uuid","title":"Tenant Id"},"slug":{"type":"string","title":"Slug"},"is_published":{"type":"boolean","title":"Is Published"},"title":{"type":"string","title":"Title"},"label":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Label"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"branding":{"$ref":"#/components/schemas/StatusPageBranding"},"domain_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}],"title":"Domain Id"},"custom_hostname":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Custom Hostname"},"created_at":{"type":"string","format":"date-time","title":"Created At"},"updated_at":{"type":"string","format":"date-time","title":"Updated At"}},"type":"object","required":["id","tenant_id","slug","is_published","title","label","description","branding","domain_id","custom_hostname","created_at","updated_at"],"title":"StatusPageRead"},"StatusResponse":{"properties":{"status":{"type":"string","title":"Status"}},"type":"object","required":["status"],"title":"StatusResponse"},"TokenResponse":{"properties":{"access_token":{"type":"string","title":"Access Token"},"refresh_token":{"type":"string","title":"Refresh Token"},"token_type":{"type":"string","title":"Token Type","default":"Bearer"},"expires_in":{"type":"integer","title":"Expires In","default":3600},"scope":{"type":"string","title":"Scope","default":""},"granted_tenants":{"items":{"type":"string"},"type":"array","title":"Granted Tenants","default":[]}},"type":"object","required":["access_token","refresh_token"],"title":"TokenResponse"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"},"AccessibleProjectRead":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"name":{"type":"string","title":"Name"},"access":{"$ref":"#/components/schemas/GrantAccess"}},"type":"object","required":["id","name","access"],"title":"AccessibleProjectRead"},"AutomationDeployRequest":{"properties":{"application_id":{"type":"string","format":"uuid","title":"Application Id"},"commit_ref":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Commit Ref"},"env_overrides":{"anyOf":[{"additionalProperties":{"type":"string"},"type":"object"},{"type":"null"}],"title":"Env Overrides"},"timeout_seconds":{"type":"integer","maximum":900.0,"minimum":1.0,"title":"Timeout Seconds","default":60},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["application_id"],"title":"AutomationDeployRequest"},"AutomationDeployResponse":{"properties":{"operation_id":{"type":"string","title":"Operation Id"},"status":{"type":"string","title":"Status"},"deployment_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Deployment Id"}},"type":"object","required":["operation_id","status"],"title":"AutomationDeployResponse"},"AutomationExecRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"command":{"type":"string","maxLength":8192,"minLength":1,"title":"Command"},"working_directory":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Working Directory"},"env":{"anyOf":[{"additionalProperties":{"type":"string"},"type":"object"},{"type":"null"}],"title":"Env"},"timeout_seconds":{"type":"integer","maximum":900.0,"minimum":1.0,"title":"Timeout Seconds","default":60},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id","command"],"title":"AutomationExecRequest"},"AutomationExecResponse":{"properties":{"operation_id":{"type":"string","title":"Operation Id"},"status":{"type":"string","title":"Status"},"exit_code":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Exit Code"},"stdout":{"type":"string","title":"Stdout","default":""},"stderr":{"type":"string","title":"Stderr","default":""},"duration_ms":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Duration Ms"}},"type":"object","required":["operation_id","status"],"title":"AutomationExecResponse"},"AutomationOperationDetail":{"properties":{"operation_id":{"type":"string","title":"Operation Id"},"operation_type":{"type":"string","title":"Operation Type"},"server_id":{"type":"string","title":"Server Id"},"server_name":{"type":"string","title":"Server Name"},"status":{"type":"string","title":"Status"},"result":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Result"},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Run Context"},"started_at":{"type":"string","format":"date-time","title":"Started At"},"completed_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Completed At"}},"type":"object","required":["operation_id","operation_type","server_id","server_name","status","started_at"],"title":"AutomationOperationDetail"},"AutomationOperationResponse":{"properties":{"operation_id":{"type":"string","title":"Operation Id"},"status":{"type":"string","title":"Status"}},"type":"object","required":["operation_id","status"],"title":"AutomationOperationResponse"},"AutomationRebootRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id"],"title":"AutomationRebootRequest"},"AutomationRegistryLoginDirectRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"registry_url":{"type":"string","maxLength":500,"minLength":1,"title":"Registry Url"},"username":{"type":"string","maxLength":255,"minLength":1,"title":"Username"},"access_token":{"type":"string","format":"password","title":"Access Token","writeOnly":true},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id","registry_url","username","access_token"],"title":"AutomationRegistryLoginDirectRequest","description":"Passthrough variant of registry login.\n\nCarries username + access token directly instead of resolving via a vaulted\nRegistryCredential. Gated by AutomationApiKey.allow_registry_passthrough."},"AutomationRegistryLoginRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"credential_id":{"type":"string","format":"uuid","title":"Credential Id"},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id","credential_id"],"title":"AutomationRegistryLoginRequest"},"AutomationRegistryLoginResponse":{"properties":{"operation_id":{"type":"string","title":"Operation Id"},"status":{"type":"string","title":"Status"},"registry_url":{"type":"string","title":"Registry Url"},"registry_type":{"type":"string","title":"Registry Type"}},"type":"object","required":["operation_id","status","registry_url","registry_type"],"title":"AutomationRegistryLoginResponse"},"AutomationRegistryLogoutRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"registry_url":{"type":"string","maxLength":500,"minLength":1,"title":"Registry Url"},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id","registry_url"],"title":"AutomationRegistryLogoutRequest"},"AutomationRestartRequest":{"properties":{"server_id":{"type":"string","format":"uuid","title":"Server Id"},"container_name":{"type":"string","minLength":1,"title":"Container Name"},"run_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Run Id"},"run_context":{"anyOf":[{"$ref":"#/components/schemas/RunContext"},{"type":"null"}]}},"type":"object","required":["server_id","container_name"],"title":"AutomationRestartRequest"},"GrantAccess":{"type":"string","enum":["read","read_write"],"title":"GrantAccess"},"OpenSessionRequest":{"properties":{"project_ids":{"items":{"type":"string","format":"uuid"},"type":"array","minItems":1,"title":"Project Ids"},"workflow_run_id":{"anyOf":[{"type":"string","maxLength":120},{"type":"null"}],"title":"Workflow Run Id"},"commit_sha":{"anyOf":[{"type":"string","maxLength":80},{"type":"null"}],"title":"Commit Sha"}},"type":"object","required":["project_ids"],"title":"OpenSessionRequest"},"OpenSessionResponse":{"properties":{"session_id":{"type":"string","format":"uuid","title":"Session Id"},"session_token":{"type":"string","title":"Session Token"},"expires_at":{"type":"string","format":"date-time","title":"Expires At"},"project_ids":{"items":{"type":"string","format":"uuid"},"type":"array","title":"Project Ids"}},"type":"object","required":["session_id","session_token","expires_at","project_ids"],"title":"OpenSessionResponse"},"ResolveRequest":{"properties":{"project_ids":{"items":{"type":"string","format":"uuid"},"type":"array","title":"Project Ids"},"refs":{"items":{"$ref":"#/components/schemas/_Ref"},"type":"array","title":"Refs"}},"type":"object","title":"ResolveRequest"},"ResolveResponse":{"properties":{"values":{"additionalProperties":{"type":"string"},"type":"object","title":"Values"}},"type":"object","required":["values"],"title":"ResolveResponse"},"RunContext":{"properties":{"provider":{"type":"string","title":"Provider","default":""},"repository":{"type":"string","title":"Repository","default":""},"workflow":{"type":"string","title":"Workflow","default":""},"trigger":{"type":"string","title":"Trigger","default":""},"actor":{"type":"string","title":"Actor","default":""},"sha":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sha"},"ref":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ref"}},"type":"object","title":"RunContext","description":"CI/CD context metadata for audit trail."},"_Ref":{"properties":{"project_id":{"type":"string","format":"uuid","title":"Project Id"},"secret_key":{"type":"string","title":"Secret Key"}},"type":"object","required":["project_id","secret_key"],"title":"_Ref"}},"securitySchemes":{"HTTPBearer":{"type":"http","scheme":"bearer"},"OAuth2":{"type":"oauth2","description":"OAuth 2.0 with PKCE. CLIs and agents use the device flow (`POST /oauth/device`). Request only the scopes you need.","flows":{"authorizationCode":{"authorizationUrl":"https://auth.reoclo.com/oauth/authorize","tokenUrl":"https://auth.reoclo.com/oauth/token","scopes":{"openid":"OpenID Connect authentication","profile":"Read the user's name and email","tenant.read":"Read data in the selected organization","tenant.write":"Create and change data in the selected organization"}}}},"AutomationKey":{"type":"http","scheme":"bearer","bearerFormat":"rca_...","description":"Automation key for CI/CD and unattended jobs. Each key is scoped to named operations and, optionally, to specific servers and source IPs. Create keys in the dashboard under Automation Keys."}}},"servers":[{"url":"https://api.reoclo.com","description":"Reoclo production API"}]}