{
  "components": {
    "parameters": {
      "IdempotencyKey": {
        "description": "Makes a retry safe: the first outcome (2xx or 4xx) is stored for 24 hours per credential and key and replayed for the same method, path, query and body (`Idempotent-Replayed: true`). Another request under the same key is 422 `idempotency_key_reused`; a retry while the first runs is 409 `idempotency_in_progress`; 5xx answers are not stored. See ADR-0016.",
        "in": "header",
        "name": "Idempotency-Key",
        "schema": {
          "maxLength": 255,
          "minLength": 1,
          "pattern": "^[\\x20-\\x7E]+$",
          "type": "string"
        }
      },
      "IfMatch": {
        "description": "ETag(s) of the representation the change is based on (from GET of the same path; `*` = any). A mismatch is 412 `precondition_failed`. Optimistic concurrency, not a lock: two writers racing in the same instant both pass.",
        "in": "header",
        "name": "If-Match",
        "schema": {
          "type": "string"
        }
      },
      "IfNoneMatch": {
        "description": "ETag(s) the client holds; when the current representation matches, the answer is 304 without a body.",
        "in": "header",
        "name": "If-None-Match",
        "schema": {
          "type": "string"
        }
      }
    },
    "responses": {
      "BadRequest": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Bad Request (`bad_request`): a malformed request."
      },
      "Forbidden": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Forbidden: `forbidden`, `csrf_failed` (an unsafe method on a session without a valid `X-CSRF-Token`), or with an API key `insufficient_scope`, `api_key_ip_denied` (outside the key's allowlist) or `api_key_not_allowed` (a session-only endpoint)."
      },
      "IdempotencyConflict": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Conflict: `idempotency_in_progress` (the first request with this Idempotency-Key is still running) or `idempotency_replay_unavailable` (it succeeded with a secret shown once)."
      },
      "IdempotencyKeyInvalid": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Bad Request: `idempotency_key_invalid` (not 1-255 printable ASCII characters), or a malformed request."
      },
      "NotModified": {
        "description": "Not Modified: the representation matches If-None-Match."
      },
      "PreconditionFailed": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Precondition Failed (`precondition_failed`): If-Match does not match the current representation (on an operation without `x-pluspanel-etag` there is none to compare, so any If-Match fails)."
      },
      "RateLimited": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Too Many Requests (`rate_limited`): the API key's rate limit (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, `RateLimit-Policy`; wait `Retry-After` seconds).",
        "headers": {
          "Retry-After": {
            "description": "Seconds to wait.",
            "schema": {
              "type": "integer"
            }
          }
        }
      },
      "ServiceUnavailable": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Service Unavailable: a dependency (the session store, an agent, a configured service) is unreachable."
      },
      "UnsupportedMediaType": {
        "content": {
          "application/problem+json": {
            "schema": {
              "$ref": "#/components/schemas/Problem"
            }
          }
        },
        "description": "Unsupported Media Type (`unsupported_media_type`): a request body that is not `application/json`."
      }
    },
    "schemas": {
      "APIKeyScopesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "default_rate_limit": {
            "description": "Requests per minute per key in the caller's edition.",
            "format": "int64",
            "type": "integer"
          },
          "resources": {
            "items": {
              "$ref": "#/components/schemas/ResourceInfo"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "wildcards": {
            "items": {
              "$ref": "#/components/schemas/ScopeWildcard"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "resources",
          "wildcards",
          "default_rate_limit"
        ],
        "type": "object"
      },
      "APIKeyTokenBody": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "$ref": "#/components/schemas/APIKeyView"
          },
          "token": {
            "description": "The secret token, shown once: send it as Authorization: Bearer \u003ctoken\u003e. Only its SHA-256 is stored.",
            "type": "string"
          }
        },
        "required": [
          "key",
          "token"
        ],
        "type": "object"
      },
      "APIKeyUsageDay": {
        "additionalProperties": false,
        "properties": {
          "day": {
            "format": "date",
            "type": "string"
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          },
          "throttled": {
            "description": "Requests refused with 429.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "day",
          "requests",
          "throttled"
        ],
        "type": "object"
      },
      "APIKeyUsageOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "description": "Days with at least one request, oldest first (counted in memory, written about once a minute).",
            "items": {
              "$ref": "#/components/schemas/APIKeyUsageDay"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "APIKeyView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by_user_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "display_prefix": {
            "description": "How the token starts; the rest is never shown again.",
            "examples": [
              "ppk_abcdefghijkl"
            ],
            "type": "string"
          },
          "effective_rate_limit": {
            "description": "Requests per minute actually allowed: the edition's limit or the key's when lower.",
            "format": "int64",
            "type": "integer"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "ip_allowlist": {
            "description": "CIDRs the key may be used from; empty: anywhere.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "kind": {
            "description": "personal: acts as its user; organization: acts as a service user of its own (an admin), survives the people who created it.",
            "enum": [
              "personal",
              "organization"
            ],
            "type": "string"
          },
          "last_used_at": {
            "description": "Updated at most once a minute.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "last_used_ip": {
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "public_id": {
            "description": "The public part of the token (ppk_\u003cpublic_id\u003e_…): shown in lists and the audit log.",
            "type": "string"
          },
          "rate_limit_per_minute": {
            "description": "The key's own limit; null: the edition's.",
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "revoked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "rotated_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "scopes": {
            "description": "\u003cresource\u003e:read, \u003cresource\u003e:write, *:read or * (GET /api-keys/scopes).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "source": {
            "description": "Where it was created: the panel, the API (by another key) or the CLI device flow.",
            "enum": [
              "panel",
              "api",
              "device"
            ],
            "type": "string"
          },
          "user_email": {
            "description": "The owner of a personal key; null for organization keys.",
            "type": [
              "string",
              "null"
            ]
          },
          "user_id": {
            "description": "The user the key acts as (the service user of an organization key).",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "public_id",
          "display_prefix",
          "name",
          "kind",
          "source",
          "user_id",
          "user_email",
          "created_by_user_id",
          "scopes",
          "ip_allowlist",
          "rate_limit_per_minute",
          "effective_rate_limit",
          "expires_at",
          "last_used_at",
          "last_used_ip",
          "created_at",
          "rotated_at",
          "revoked_at"
        ],
        "type": "object"
      },
      "AccountAllocationView": {
        "additionalProperties": false,
        "properties": {
          "mcs_level": {
            "examples": [
              "s0:c0,c1"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "project_id": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "slot": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "subid_count": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "subid_start": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "uid": {
            "description": "uid = gid of the account's system user.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "username": {
            "type": [
              "string",
              "null"
            ]
          },
          "volume_path": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "slot",
          "username",
          "uid",
          "subid_start",
          "subid_count",
          "mcs_level",
          "project_id",
          "volume_path"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "AccountBackupsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "available": {
            "description": "Backups are configured on this control plane.",
            "type": "boolean"
          },
          "exports": {
            "items": {
              "$ref": "#/components/schemas/BackupExportView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restores": {
            "items": {
              "$ref": "#/components/schemas/BackupRestoreView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "retention": {
            "$ref": "#/components/schemas/RetentionView",
            "description": "The policy the account's snapshots follow."
          },
          "retention_custom": {
            "description": "The account has its own policy.",
            "type": "boolean"
          },
          "snapshots": {
            "description": "Newest first (at most 200).",
            "items": {
              "$ref": "#/components/schemas/BackupSnapshotView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "squeezed": {
            "description": "The organization is over its quota: retention is tightened until it fits.",
            "type": "boolean"
          }
        },
        "required": [
          "available",
          "snapshots",
          "restores",
          "exports",
          "retention",
          "retention_custom",
          "squeezed"
        ],
        "type": "object"
      },
      "AccountRuntimeView": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "Host loopback address the account's services are published on.",
            "examples": [
              "127.64.0.1"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "agent_state": {
            "description": "State the agent reports: ready, degraded or unspecified; null until reported.",
            "examples": [
              "ready"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "applied_cpu_millicores": {
            "description": "CPU envelope the agent applied.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "applied_memory_bytes": {
            "description": "Memory envelope the agent applied.",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "detail": {
            "description": "Agent explanation when not ready.",
            "type": [
              "string",
              "null"
            ]
          },
          "job_id": {
            "description": "Most recent runtime job (ensure/remove) of the account.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "last_error": {
            "description": "\"\u003cerror_code\u003e: \u003cmessage\u003e\" of the last failed runtime job.",
            "type": [
              "string",
              "null"
            ]
          },
          "last_error_code": {
            "description": "Agent error code of the last failed runtime job (runtime_*), or job_failed / job_dead / job_cancelled.",
            "examples": [
              "runtime_not_ready"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "description": "none (never ensured, or removed), ensuring / removing (runtime job in flight), ready, failed (see last_error; the next deploy or POST .../runtime ensures again).",
            "enum": [
              "none",
              "ensuring",
              "ready",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "subnet": {
            "description": "Subnet of the account network.",
            "examples": [
              "10.128.0.0/24"
            ],
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "status",
          "job_id",
          "last_error_code",
          "last_error",
          "agent_state",
          "address",
          "subnet",
          "applied_cpu_millicores",
          "applied_memory_bytes",
          "detail",
          "reported_at"
        ],
        "type": "object"
      },
      "AccountServerUpdatesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "history": {
            "description": "Past updates, newest first.",
            "items": {
              "$ref": "#/components/schemas/ClientMaintenanceView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "maintenance": {
            "description": "Scheduled or in progress (the banner).",
            "items": {
              "$ref": "#/components/schemas/ClientMaintenanceView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "account_id",
          "maintenance",
          "history"
        ],
        "type": "object"
      },
      "AccountSummaryView": {
        "additionalProperties": false,
        "properties": {
          "bytes_used": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "inodes_used": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "owner_user_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "plan_id": {
            "format": "uuid",
            "type": "string"
          },
          "plan_name": {
            "type": "string"
          },
          "quota_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "server_name": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "server_id",
          "server_name",
          "plan_id",
          "plan_name",
          "owner_user_id",
          "quota_bytes",
          "bytes_used",
          "inodes_used",
          "reported_at",
          "created_at"
        ],
        "type": "object"
      },
      "AccountUsageView": {
        "additionalProperties": false,
        "properties": {
          "agent_state": {
            "description": "Volume state as the agent reports it.",
            "enum": [
              "unspecified",
              "active",
              "quarantined"
            ],
            "type": "string"
          },
          "bytes_limit": {
            "description": "Hard block limit in bytes, as enforced on the server.",
            "format": "int64",
            "type": "integer"
          },
          "bytes_used": {
            "description": "Bytes used (kernel project quota accounting).",
            "format": "int64",
            "type": "integer"
          },
          "inodes_limit": {
            "format": "int64",
            "type": "integer"
          },
          "inodes_used": {
            "format": "int64",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "agent_state",
          "bytes_used",
          "bytes_limit",
          "inodes_used",
          "inodes_limit",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "AccountUserView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "role_in_account": {
            "enum": [
              "owner",
              "collaborator"
            ],
            "type": "string"
          },
          "user": {
            "$ref": "#/components/schemas/UserView"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "account_id",
          "user_id",
          "role_in_account",
          "created_at"
        ],
        "type": "object"
      },
      "AccountUsersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AccountUserView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "AccountView": {
        "additionalProperties": false,
        "properties": {
          "allocation": {
            "$ref": "#/components/schemas/AccountAllocationView",
            "description": "Identity primitives; null until reported."
          },
          "cpu_millicores": {
            "description": "CPU envelope of the account's containers in millicores (1000 = one CPU), 100 to 64000 (M08-core).",
            "format": "int32",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "inode_limit": {
            "description": "Confirmed hard inode limit.",
            "format": "int64",
            "type": "integer"
          },
          "last_error": {
            "description": "Error of the last failed storage job, \"\u003cerror_code\u003e: \u003cmessage\u003e\"; null after a success.",
            "type": [
              "string",
              "null"
            ]
          },
          "last_error_code": {
            "description": "Error code of the last failed storage job: an agent code (storage_not_ready, storage_invalid_argument, storage_account_not_found, storage_account_quarantined, storage_confirm_token_mismatch, storage_exhausted, storage_host_error, storage_probe_privileged, storage_quota_below_usage) or job_failed / job_dead / job_cancelled; null after a success.",
            "examples": [
              "storage_not_ready"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "last_job_id": {
            "description": "Most recent storage job of this account (GET /jobs/{id}).",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "limits": {
            "$ref": "#/components/schemas/PlanFields",
            "description": "Effective limits: the plan with the overrides applied. quota_bytes/inode_limit/cpu_millicores/memory_bytes above are the live values, which converge to these."
          },
          "memory_bytes": {
            "description": "Memory envelope of the account's containers in bytes, 64 MiB to 256 GiB (M08-core).",
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "overrides": {
            "additionalProperties": {},
            "description": "Per-account exceptions to the plan (accounts.override).",
            "type": "object"
          },
          "owner_user_id": {
            "description": "The reseller that owns the account; null = the organization.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "plan_id": {
            "description": "The account's hosting plan.",
            "format": "uuid",
            "type": "string"
          },
          "plan_name": {
            "type": "string"
          },
          "provisioned_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "purged_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "quarantined_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "quota_bytes": {
            "description": "Confirmed hard block limit (changes only when the agent confirms an update).",
            "format": "int64",
            "type": "integer"
          },
          "runtime": {
            "$ref": "#/components/schemas/AccountRuntimeView",
            "description": "Container runtime of the account (M08-core)."
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "provisioning",
              "active",
              "removing",
              "quarantined"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "usage": {
            "$ref": "#/components/schemas/AccountUsageView",
            "description": "Live usage from the latest heartbeat; null until the agent reports the account."
          }
        },
        "required": [
          "id",
          "server_id",
          "name",
          "status",
          "quota_bytes",
          "inode_limit",
          "last_job_id",
          "last_error_code",
          "last_error",
          "created_at",
          "updated_at",
          "provisioned_at",
          "quarantined_at",
          "purged_at",
          "usage",
          "allocation",
          "cpu_millicores",
          "memory_bytes",
          "runtime",
          "plan_id",
          "owner_user_id",
          "overrides"
        ],
        "type": "object"
      },
      "AckAlertInputBody": {
        "additionalProperties": false,
        "properties": {
          "comment": {
            "maxLength": 500,
            "type": "string"
          }
        },
        "type": "object"
      },
      "AckAuditAlertInputBody": {
        "additionalProperties": false,
        "properties": {
          "reason": {
            "description": "Why the break is understood (incident reference).",
            "maxLength": 1000,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "reason"
        ],
        "type": "object"
      },
      "AcmeStatusView": {
        "additionalProperties": false,
        "properties": {
          "configured": {
            "description": "The agent received the platform's ACME configuration; issuance waits for it.",
            "type": "boolean"
          },
          "email": {
            "description": "ACME account contact the agent holds.",
            "type": "string"
          },
          "next_check_at": {
            "description": "Next scheduled renewal check.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "production_default": {
            "description": "Endpoint of sites without a TLS policy (true production, false staging).",
            "type": "boolean"
          },
          "production_registered": {
            "type": "boolean"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "staging_registered": {
            "type": "boolean"
          },
          "test_hooks": {
            "description": "Drill hooks are set (lab servers).",
            "type": "boolean"
          }
        },
        "required": [
          "email",
          "production_default",
          "staging_registered",
          "production_registered",
          "next_check_at",
          "test_hooks",
          "configured",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "AddAccountUserInputBody": {
        "additionalProperties": false,
        "properties": {
          "role_in_account": {
            "enum": [
              "owner",
              "collaborator"
            ],
            "type": "string"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "role_in_account"
        ],
        "type": "object"
      },
      "AddBackupAddonInputBody": {
        "additionalProperties": false,
        "properties": {
          "size_gb": {
            "enum": [
              100,
              250,
              500,
              1000
            ],
            "format": "int32",
            "type": "integer"
          },
          "tier": {
            "enum": [
              "standard",
              "premium"
            ],
            "type": "string"
          }
        },
        "required": [
          "tier",
          "size_gb"
        ],
        "type": "object"
      },
      "AddWAFExclusionInputBody": {
        "additionalProperties": false,
        "properties": {
          "path_prefix": {
            "description": "Request path prefix starting with '/', [A-Za-z0-9/._~%-], without /./, /../, // or a trailing /..; empty: the whole site.",
            "maxLength": 256,
            "type": "string"
          },
          "rule_id": {
            "description": "OWASP CRS rule id.",
            "format": "int64",
            "maximum": 999999,
            "minimum": 100000,
            "type": "integer"
          }
        },
        "required": [
          "rule_id"
        ],
        "type": "object"
      },
      "AgentStatus": {
        "additionalProperties": false,
        "properties": {
          "changed_at": {
            "format": "date-time",
            "type": "string"
          },
          "image_version": {
            "type": "string"
          },
          "previous_version": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "release_digest": {
            "type": "string"
          },
          "release_version": {
            "type": "string"
          },
          "running_version": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "running_version",
          "image_version",
          "release_version",
          "release_digest",
          "previous_version",
          "state",
          "reason"
        ],
        "type": "object"
      },
      "AgentUpdateView": {
        "additionalProperties": false,
        "properties": {
          "confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": [
              "string",
              "null"
            ]
          },
          "digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "job_id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "apply",
              "rollback"
            ],
            "type": "string"
          },
          "previous_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "restarted_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "restarting",
              "confirmed",
              "failed"
            ],
            "type": "string"
          },
          "version": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "job_id",
          "kind",
          "version",
          "digest",
          "previous_version",
          "status",
          "reason",
          "detail",
          "restarted_at",
          "confirmed_at",
          "created_at"
        ],
        "type": "object"
      },
      "AlertEventView": {
        "additionalProperties": false,
        "properties": {
          "actor_user_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "kind": {
            "enum": [
              "pending",
              "firing",
              "severity",
              "resolved",
              "acknowledged",
              "notified"
            ],
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "severity": {
            "type": "string"
          },
          "value": {
            "format": "double",
            "type": [
              "number",
              "null"
            ]
          }
        },
        "required": [
          "kind",
          "severity",
          "value",
          "message",
          "actor_user_id",
          "created_at"
        ],
        "type": "object"
      },
      "AlertOutputBody": {
        "additionalProperties": false,
        "properties": {
          "alert": {
            "$ref": "#/components/schemas/AlertView"
          },
          "events": {
            "items": {
              "$ref": "#/components/schemas/AlertEventView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "exit_report": {
            "$ref": "#/components/schemas/ExitReportView"
          }
        },
        "required": [
          "alert",
          "events"
        ],
        "type": "object"
      },
      "AlertRuleView": {
        "additionalProperties": false,
        "properties": {
          "custom": {
            "description": "The organization changed this rule.",
            "type": "boolean"
          },
          "doc": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "kind": {
            "type": "string"
          },
          "no_source": {
            "description": "Registered, but nothing feeds it yet.",
            "type": "boolean"
          },
          "operator": {
            "description": "Evaluated for the operator organization only.",
            "type": "boolean"
          },
          "parameters": {
            "description": "Parameter table: name, default, bounds.",
            "items": {
              "$ref": "#/components/schemas/Param"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "params": {
            "additionalProperties": {
              "format": "double",
              "type": "number"
            },
            "description": "Effective parameters.",
            "type": "object"
          }
        },
        "required": [
          "kind",
          "doc",
          "enabled",
          "operator",
          "no_source",
          "params",
          "parameters",
          "custom"
        ],
        "type": "object"
      },
      "AlertRulesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AlertRuleView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "AlertView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "acked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "acked_by": {
            "type": [
              "string",
              "null"
            ]
          },
          "details": {
            "additionalProperties": {},
            "type": "object"
          },
          "fired_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_seen_at": {
            "format": "date-time",
            "type": "string"
          },
          "resolved_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "rule": {
            "type": "string"
          },
          "server_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "server_name": {
            "description": "Name of the alert's server (lists only).",
            "type": [
              "string",
              "null"
            ]
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "critical"
            ],
            "type": "string"
          },
          "silenced": {
            "description": "An active silence mutes its notifications.",
            "type": "boolean"
          },
          "site_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "started_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "pending",
              "firing",
              "resolved"
            ],
            "type": "string"
          },
          "subject": {
            "type": "string"
          },
          "summary": {
            "type": "string"
          },
          "value": {
            "format": "double",
            "type": [
              "number",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "rule",
          "severity",
          "state",
          "server_id",
          "account_id",
          "site_id",
          "subject",
          "summary",
          "value",
          "details",
          "started_at",
          "fired_at",
          "resolved_at",
          "last_seen_at",
          "acked_by",
          "acked_at",
          "server_name",
          "silenced"
        ],
        "type": "object"
      },
      "AlertsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AlertView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "AppliedSiteView": {
        "additionalProperties": false,
        "properties": {
          "policy_sha256": {
            "type": "string"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "waf_mode": {
            "enum": [
              "",
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          }
        },
        "required": [
          "waf_mode",
          "policy_sha256",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "ApproveDeviceInputBody": {
        "additionalProperties": false,
        "properties": {
          "expires_in_days": {
            "default": 90,
            "description": "Lifetime of the key.",
            "format": "int64",
            "maximum": 365,
            "minimum": 1,
            "type": "integer"
          },
          "scopes": {
            "description": "The key's scopes; default [\"*\"] (everything you may do).",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "ArchivePlanInputBody": {
        "additionalProperties": false,
        "properties": {
          "archived": {
            "type": "boolean"
          }
        },
        "required": [
          "archived"
        ],
        "type": "object"
      },
      "AttributionView": {
        "additionalProperties": false,
        "properties": {
          "license": {
            "type": "string"
          },
          "text": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "text",
          "url",
          "license"
        ],
        "type": "object"
      },
      "AuditActorView": {
        "additionalProperties": false,
        "properties": {
          "deleted": {
            "description": "The user was deleted (pseudonymized): show it as Deleted user \u003cshort id\u003e.",
            "type": "boolean"
          },
          "email": {
            "description": "Only for organization-wide readers.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "description": "Display name; empty when deleted or unknown.",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "deleted"
        ],
        "type": "object"
      },
      "AuditAlertView": {
        "additionalProperties": false,
        "properties": {
          "ack_reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "acked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "acked_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "code": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "message": {
            "type": "string"
          },
          "seq": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "code",
          "seq",
          "message",
          "created_at",
          "acked_by",
          "ack_reason",
          "acked_at"
        ],
        "type": "object"
      },
      "AuditAnchorView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "day": {
            "format": "date",
            "type": "string"
          },
          "key_id": {
            "type": "string"
          },
          "last_hash": {
            "description": "Operator tenant only.",
            "type": "string"
          },
          "last_seq": {
            "description": "Operator tenant only.",
            "format": "int64",
            "type": "integer"
          },
          "object_key": {
            "description": "Operator tenant only.",
            "type": "string"
          },
          "retain_until": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "uploaded": {
            "type": "boolean"
          },
          "worm": {
            "description": "Written with Object Lock COMPLIANCE.",
            "type": "boolean"
          }
        },
        "required": [
          "day",
          "key_id",
          "created_at",
          "uploaded",
          "worm",
          "retain_until"
        ],
        "type": "object"
      },
      "AuditChainView": {
        "additionalProperties": false,
        "properties": {
          "alerts": {
            "description": "Operator tenant only: open alerts first, then recent acknowledged ones.",
            "items": {
              "$ref": "#/components/schemas/AuditAlertView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "anchor_key_id": {
            "type": "string"
          },
          "anchors": {
            "items": {
              "$ref": "#/components/schemas/AuditAnchorView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "anchors_enabled": {
            "type": "boolean"
          },
          "head_sealed_at": {
            "description": "Operator tenant only.",
            "format": "date-time",
            "type": "string"
          },
          "head_seq": {
            "description": "Operator tenant only.",
            "format": "int64",
            "type": "integer"
          },
          "last_ok_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "last_verification": {
            "$ref": "#/components/schemas/AuditVerificationView",
            "description": "Operator tenant only."
          },
          "last_verified_at": {
            "description": "When the latest verification finished.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "ok": {
            "description": "The latest verification passed (or none ran yet).",
            "type": "boolean"
          },
          "open_alerts": {
            "description": "Operator tenant only (0 elsewhere).",
            "format": "int64",
            "type": "integer"
          },
          "operator": {
            "description": "The caller is an operator admin (alerts, verify and acknowledge).",
            "type": "boolean"
          },
          "own_last_sealed_at": {
            "description": "When this organization's newest event was sealed.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "own_unsealed": {
            "description": "This organization's events of the last 24 hours that are not sealed yet (sealing takes about 2 seconds).",
            "format": "int64",
            "type": "integer"
          },
          "worm": {
            "enum": [
              "available",
              "unavailable",
              "disabled"
            ],
            "type": "string"
          }
        },
        "required": [
          "ok",
          "operator",
          "last_verified_at",
          "last_ok_at",
          "own_unsealed",
          "own_last_sealed_at",
          "anchors_enabled",
          "worm",
          "anchor_key_id",
          "anchors",
          "alerts",
          "open_alerts"
        ],
        "type": "object"
      },
      "AuditVerificationView": {
        "additionalProperties": false,
        "properties": {
          "anchors": {
            "format": "int32",
            "type": "integer"
          },
          "checked": {
            "format": "int64",
            "type": "integer"
          },
          "findings": {
            "items": {
              "$ref": "#/components/schemas/Finding"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "finished_at": {
            "format": "date-time",
            "type": "string"
          },
          "from_seq": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "kind": {
            "enum": [
              "incremental",
              "full",
              "range"
            ],
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "to_seq": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "kind",
          "ok",
          "from_seq",
          "to_seq",
          "checked",
          "anchors",
          "findings",
          "finished_at"
        ],
        "type": "object"
      },
      "AuditView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "action": {
            "type": "string"
          },
          "actor": {
            "$ref": "#/components/schemas/AuditActorView"
          },
          "actor_user_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "details": {
            "additionalProperties": {},
            "type": "object"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "object_id": {
            "type": "string"
          },
          "object_type": {
            "type": "string"
          },
          "on_behalf_of_user": {
            "$ref": "#/components/schemas/AuditActorView"
          },
          "on_behalf_of_user_id": {
            "description": "Set when the actor acted as this user (impersonation).",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "actor_user_id",
          "on_behalf_of_user_id",
          "account_id",
          "action",
          "object_type",
          "object_id",
          "details",
          "created_at"
        ],
        "type": "object"
      },
      "BYOInputBody": {
        "additionalProperties": false,
        "properties": {
          "access_key": {
            "maxLength": 256,
            "type": "string"
          },
          "bucket": {
            "maxLength": 63,
            "type": "string"
          },
          "endpoint": {
            "description": "host[:port], e.g. s3.eu-central-1.amazonaws.com.",
            "maxLength": 253,
            "type": "string"
          },
          "path_style": {
            "type": "boolean"
          },
          "prefix": {
            "maxLength": 200,
            "type": "string"
          },
          "region": {
            "maxLength": 64,
            "type": "string"
          },
          "secret_key": {
            "description": "Stored encrypted in the organization's vault; never returned.",
            "maxLength": 256,
            "type": "string"
          },
          "secure": {
            "default": true,
            "type": "boolean"
          }
        },
        "required": [
          "endpoint",
          "bucket",
          "access_key",
          "secret_key"
        ],
        "type": "object"
      },
      "BYOView": {
        "additionalProperties": false,
        "properties": {
          "access_key_hint": {
            "description": "The first four characters of the access key.",
            "type": "string"
          },
          "bucket": {
            "type": "string"
          },
          "configured": {
            "type": "boolean"
          },
          "endpoint": {
            "type": "string"
          },
          "path_style": {
            "type": "boolean"
          },
          "prefix": {
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "secure": {
            "type": "boolean"
          }
        },
        "required": [
          "configured",
          "endpoint",
          "region",
          "bucket",
          "prefix",
          "access_key_hint",
          "secure",
          "path_style"
        ],
        "type": "object"
      },
      "BackupAddonListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BackupAddonView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BackupAddonView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "size_gb": {
            "enum": [
              100,
              250,
              500,
              1000
            ],
            "format": "int32",
            "type": "integer"
          },
          "tier": {
            "enum": [
              "standard",
              "premium"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "tier",
          "size_gb",
          "created_at"
        ],
        "type": "object"
      },
      "BackupAlertListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BackupAlertView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BackupAlertView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "acknowledged_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "details": {},
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "description": "run_failed, run_partial, quota_over, check_failed, test_failed, restore_failed, pre_update_failed, …",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "resolved_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "error"
            ],
            "type": "string"
          },
          "subject": {
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "kind",
          "severity",
          "subject",
          "server_id",
          "account_id",
          "message",
          "details",
          "created_at",
          "updated_at",
          "resolved_at",
          "acknowledged_at"
        ],
        "type": "object"
      },
      "BackupExportView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "archive_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "download_url": {
            "description": "Presigned (1 hour), only on GET /backup-exports/{id} when ready.",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "job_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "snapshot_id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "queued",
              "ready",
              "failed",
              "expired"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "snapshot_id",
          "state",
          "job_id",
          "archive_bytes",
          "error",
          "created_at",
          "expires_at"
        ],
        "type": "object"
      },
      "BackupJobOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "format": "uuid",
            "type": "string"
          },
          "run_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "job_id"
        ],
        "type": "object"
      },
      "BackupMaintenanceInputBody": {
        "additionalProperties": false,
        "properties": {
          "kind": {
            "enum": [
              "prune",
              "check_sample",
              "check_full"
            ],
            "type": "string"
          },
          "tier": {
            "description": "Default: the server's tier.",
            "enum": [
              "standard",
              "premium",
              "byo"
            ],
            "type": "string"
          }
        },
        "required": [
          "kind"
        ],
        "type": "object"
      },
      "BackupOverviewOutputBody": {
        "additionalProperties": false,
        "properties": {
          "addons": {
            "items": {
              "$ref": "#/components/schemas/BackupAddonView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "alerts": {
            "description": "Open alerts.",
            "items": {
              "$ref": "#/components/schemas/BackupAlertView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "available": {
            "type": "boolean"
          },
          "byo_s3": {
            "$ref": "#/components/schemas/BYOView"
          },
          "edition": {
            "type": "string"
          },
          "premium_available": {
            "type": "boolean"
          },
          "quotas": {
            "description": "Standard and Premium (quota_bytes -1: unlimited).",
            "items": {
              "$ref": "#/components/schemas/Quota"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restore_test_months": {
            "format": "int64",
            "type": "integer"
          },
          "servers": {
            "items": {
              "$ref": "#/components/schemas/BackupServerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "settings": {
            "$ref": "#/components/schemas/BackupSettingsView"
          }
        },
        "required": [
          "available",
          "premium_available",
          "edition",
          "settings",
          "quotas",
          "addons",
          "servers",
          "alerts",
          "byo_s3",
          "restore_test_months"
        ],
        "type": "object"
      },
      "BackupRepoView": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "initialized": {
            "type": "boolean"
          },
          "objects": {
            "format": "int64",
            "type": "integer"
          },
          "size_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "size_bytes": {
            "description": "What the repository occupies (after deduplication): the quota's measure.",
            "format": "int64",
            "type": "integer"
          },
          "tier": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "tier",
          "initialized",
          "size_bytes",
          "objects",
          "size_at"
        ],
        "type": "object"
      },
      "BackupRestoreView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "before_snapshot_id": {
            "description": "The snapshot taken of what an in-place restore replaced.",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "error_code": {
            "type": "string"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "job_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "kind": {
            "enum": [
              "account",
              "site",
              "db_service",
              "database",
              "paths"
            ],
            "type": "string"
          },
          "mode": {
            "enum": [
              "in_place",
              "alternate"
            ],
            "type": "string"
          },
          "result": {
            "description": "The agent's result: counts, restored sites and services, warnings, alternate_path."
          },
          "selection": {},
          "snapshot_id": {
            "type": "string"
          },
          "stage": {
            "description": "A deleted account's preparation step (preparing).",
            "enum": [
              "",
              "purge",
              "provision",
              "runtime"
            ],
            "type": "string"
          },
          "state": {
            "enum": [
              "preparing",
              "queued",
              "running",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "target_server_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "snapshot_id",
          "target_server_id",
          "kind",
          "mode",
          "state",
          "stage",
          "selection",
          "job_id",
          "before_snapshot_id",
          "result",
          "error_code",
          "error",
          "created_at",
          "finished_at"
        ],
        "type": "object"
      },
      "BackupRunListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BackupRunView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BackupRunView": {
        "additionalProperties": false,
        "properties": {
          "attempt": {
            "description": "The try of a scheduled run: 1, or 2..4 for the retries of a failed one (ADR-0012 amendment 2026-10-16).",
            "format": "int32",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "error_code": {
            "type": "string"
          },
          "final_failure": {
            "description": "The run failed for good: no retry follows; its organization and the operator were alerted.",
            "type": "boolean"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "job_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "kind": {
            "enum": [
              "scheduled",
              "manual",
              "pre_update",
              "before_restore"
            ],
            "type": "string"
          },
          "millis": {
            "format": "int64",
            "type": "integer"
          },
          "new_bytes": {
            "description": "New data the run found (before compression).",
            "format": "int64",
            "type": "integer"
          },
          "pack_bytes": {
            "description": "Bytes uploaded (after deduplication, compression and encryption).",
            "format": "int64",
            "type": "integer"
          },
          "packs": {
            "format": "int64",
            "type": "integer"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "state": {
            "enum": [
              "queued",
              "running",
              "succeeded",
              "partial",
              "failed"
            ],
            "type": "string"
          },
          "targets": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "server_id",
          "kind",
          "state",
          "job_id",
          "targets",
          "packs",
          "pack_bytes",
          "new_bytes",
          "millis",
          "error_code",
          "error",
          "created_at",
          "finished_at",
          "attempt",
          "final_failure"
        ],
        "type": "object"
      },
      "BackupServerSettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "tier": {
            "enum": [
              "standard",
              "premium",
              "byo"
            ],
            "type": "string"
          },
          "window_minutes": {
            "format": "int32",
            "maximum": 1440,
            "minimum": 30,
            "type": "integer"
          },
          "window_start_minute": {
            "format": "int32",
            "maximum": 1439,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "BackupServerView": {
        "additionalProperties": false,
        "properties": {
          "active": {
            "description": "Engine jobs running now, from the last heartbeat."
          },
          "format_version": {
            "description": "The agent's repository format (0: no backup engine).",
            "format": "int32",
            "type": "integer"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_run": {
            "$ref": "#/components/schemas/BackupRunView",
            "description": "Absent before the first run."
          },
          "name": {
            "type": "string"
          },
          "overrides": {
            "description": "The server has its own settings.",
            "type": "boolean"
          },
          "repos": {
            "items": {
              "$ref": "#/components/schemas/BackupRepoView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "revoked": {
            "type": "boolean"
          },
          "settings": {
            "$ref": "#/components/schemas/ServerSettings"
          }
        },
        "required": [
          "id",
          "name",
          "revoked",
          "settings",
          "overrides",
          "format_version",
          "active",
          "repos"
        ],
        "type": "object"
      },
      "BackupSettingsView": {
        "additionalProperties": false,
        "properties": {
          "deleted_hold_days": {
            "description": "How long a deleted account's snapshots are kept.",
            "format": "int64",
            "maximum": 365,
            "minimum": 1,
            "type": "integer"
          },
          "enabled": {
            "type": "boolean"
          },
          "period_hours": {
            "enum": [
              1,
              2,
              3,
              4,
              6,
              8,
              12,
              24
            ],
            "format": "int64",
            "type": "integer"
          },
          "read_bytes_per_sec": {
            "description": "0: unlimited.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "retention": {
            "$ref": "#/components/schemas/RetentionView",
            "description": "Ignored on Free (the edition's policy applies)."
          },
          "retention_is_default": {
            "type": "boolean"
          },
          "tier": {
            "enum": [
              "standard",
              "premium",
              "byo"
            ],
            "type": "string"
          },
          "upload_bytes_per_sec": {
            "description": "0: unlimited.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "window_minutes": {
            "format": "int64",
            "maximum": 1440,
            "minimum": 30,
            "type": "integer"
          },
          "window_start_minute": {
            "description": "Minutes after 00:00 UTC.",
            "format": "int64",
            "maximum": 1439,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "window_start_minute",
          "window_minutes",
          "period_hours",
          "tier",
          "retention",
          "retention_is_default",
          "deleted_hold_days"
        ],
        "type": "object"
      },
      "BackupSnapshotView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "id": {
            "description": "64 hex characters.",
            "type": "string"
          },
          "partial": {
            "description": "Something could not be read; the snapshot holds the rest.",
            "type": "boolean"
          },
          "reason": {
            "enum": [
              "scheduled",
              "manual",
              "pre_update",
              "before_restore"
            ],
            "type": "string"
          },
          "scope": {
            "enum": [
              "account",
              "site",
              "db_service"
            ],
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "service_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "site_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "stats": {
            "description": "Engine counters: files, bytes, new_bytes, … (live size)."
          },
          "taken_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "server_id",
          "scope",
          "site_id",
          "service_id",
          "reason",
          "taken_at",
          "partial",
          "stats"
        ],
        "type": "object"
      },
      "BackupTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "abort_after_packs": {
            "description": "The next backup run aborts after this many packs (interruption drill); 0 clears.",
            "format": "int32",
            "maximum": 100000,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "abort_after_packs"
        ],
        "type": "object"
      },
      "BackupTestListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BackupTestView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BackupTestQuotaInputBody": {
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "description": "Cap both tiers' quota at this many bytes; 0 clears.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "bytes"
        ],
        "type": "object"
      },
      "BackupTestView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "forced": {
            "type": "boolean"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "job_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "result": {
            "description": "Per check: HTTP status, database query, file checksums; sandbox cleanup."
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "snapshot_id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "queued",
              "running",
              "passed",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "server_id",
          "account_id",
          "snapshot_id",
          "forced",
          "state",
          "job_id",
          "result",
          "created_at",
          "finished_at"
        ],
        "type": "object"
      },
      "BanListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BanView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BanView": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "As the agent reports it: an IPv4 address, or the network address of an IPv6 /64.",
            "type": "string"
          },
          "banned_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "failures": {
            "format": "int32",
            "type": "integer"
          },
          "network": {
            "type": "string"
          },
          "service": {
            "type": "string"
          }
        },
        "required": [
          "address",
          "network",
          "service",
          "failures",
          "banned_at",
          "expires_at"
        ],
        "type": "object"
      },
      "BrandingView": {
        "additionalProperties": false,
        "properties": {
          "accent_color": {
            "type": [
              "string",
              "null"
            ]
          },
          "logo_url": {
            "description": "Relative URL of the logo (changes when the logo does).",
            "type": [
              "string",
              "null"
            ]
          },
          "primary_color": {
            "examples": [
              "#1d4ed8"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "product_name": {
            "type": [
              "string",
              "null"
            ]
          },
          "support_email": {
            "type": [
              "string",
              "null"
            ]
          },
          "support_url": {
            "type": [
              "string",
              "null"
            ]
          },
          "terminology": {
            "additionalProperties": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "description": "Per locale (ro, en, es): translation key → text.",
            "type": "object"
          },
          "updated_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "product_name",
          "primary_color",
          "accent_color",
          "logo_url",
          "terminology",
          "support_email",
          "support_url"
        ],
        "type": "object"
      },
      "BrowseBackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "offset": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "path": {
            "description": "Snapshot path, e.g. files/web/\u003csite-key\u003e/wp-content (empty: the root).",
            "maxLength": 4096,
            "type": "string"
          },
          "snapshot_id": {
            "pattern": "^[0-9a-f]{64}$",
            "type": "string"
          }
        },
        "required": [
          "snapshot_id"
        ],
        "type": "object"
      },
      "BruteForceBody": {
        "additionalProperties": false,
        "properties": {
          "ban_seconds": {
            "description": "First ban; a repeat within 24 h doubles it, up to 24 h.",
            "format": "int64",
            "maximum": 86400,
            "minimum": 60,
            "type": "integer"
          },
          "enabled": {
            "type": "boolean"
          },
          "max_failures": {
            "description": "Failures within the window that ban an address.",
            "format": "int64",
            "maximum": 1000,
            "minimum": 1,
            "type": "integer"
          },
          "never_ban": {
            "description": "Prefixes never banned (CIDR).",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "window_seconds": {
            "format": "int64",
            "maximum": 86400,
            "minimum": 10,
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "max_failures",
          "window_seconds",
          "ban_seconds"
        ],
        "type": "object"
      },
      "CatalogEntryView": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "description": "Tag the digest is resolved from at deploy time.",
            "examples": [
              "stable"
            ],
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "mounts_profile": {
            "description": "Default mount profile.",
            "enum": [
              "static",
              "php"
            ],
            "type": "string"
          },
          "name": {
            "examples": [
              "nginx-static"
            ],
            "type": "string"
          },
          "repository": {
            "description": "Repository in the platform registry.",
            "examples": [
              "apps/nginx-static"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "repository",
          "description",
          "mounts_profile",
          "channel"
        ],
        "type": "object"
      },
      "CatalogOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/CatalogEntryView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ChangePasswordInputBody": {
        "additionalProperties": false,
        "properties": {
          "current_password": {
            "maxLength": 256,
            "minLength": 1,
            "type": "string"
          },
          "new_password": {
            "maxLength": 256,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "current_password",
          "new_password"
        ],
        "type": "object"
      },
      "ChannelConfig": {
        "additionalProperties": false,
        "properties": {
          "addresses": {
            "description": "email: recipients (bare addresses).",
            "items": {
              "type": "string"
            },
            "maxItems": 10,
            "type": [
              "array",
              "null"
            ]
          },
          "chat_id": {
            "description": "telegram: chat id or @channel.",
            "maxLength": 40,
            "type": "string"
          },
          "locale": {
            "description": "email: language for recipients that are not users of the organization (users get their own); chat channels: message language. Default en.",
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "min_severity": {
            "description": "Drop alerts below this severity.",
            "enum": [
              "info",
              "warning",
              "critical"
            ],
            "type": "string"
          },
          "rules": {
            "description": "Only these rule kinds (empty: all).",
            "items": {
              "type": "string"
            },
            "maxItems": 32,
            "type": [
              "array",
              "null"
            ]
          },
          "target": {
            "description": "Host of the secret URL (read-only).",
            "readOnly": true,
            "type": "string"
          }
        },
        "type": "object"
      },
      "ChannelReleaseView": {
        "additionalProperties": false,
        "properties": {
          "completed_at": {
            "format": "date-time",
            "type": "string"
          },
          "digest": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "version",
          "digest",
          "completed_at"
        ],
        "type": "object"
      },
      "ChannelSecret": {
        "additionalProperties": false,
        "properties": {
          "bot_token": {
            "description": "telegram: the bot token.",
            "maxLength": 128,
            "type": "string"
          },
          "signing_key": {
            "description": "webhook: HMAC-SHA256 key of the X-PlusPanel-Signature header (optional, 16+ characters).",
            "maxLength": 256,
            "type": "string"
          },
          "url": {
            "description": "webhook, slack, discord: the HTTPS target (may carry a token).",
            "maxLength": 2048,
            "type": "string"
          }
        },
        "type": "object"
      },
      "ChannelTestOutputBody": {
        "additionalProperties": false,
        "properties": {
          "error": {
            "type": "string"
          },
          "response_code": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "status": {
            "enum": [
              "sent",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "status",
          "response_code"
        ],
        "type": "object"
      },
      "ChannelView": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "has_secret": {
            "type": "boolean"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "enum": [
              "email",
              "webhook",
              "slack",
              "discord",
              "telegram",
              "push"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "type",
          "name",
          "enabled",
          "config",
          "has_secret",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "ChannelsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ChannelView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "CheckInInputBody": {
        "additionalProperties": false,
        "properties": {
          "install_id": {
            "pattern": "^[A-Za-z0-9_-]{8,64}$",
            "type": "string"
          },
          "license_id": {
            "format": "uuid",
            "type": "string"
          },
          "servers": {
            "format": "int64",
            "maximum": 10000000,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "license_id",
          "install_id",
          "servers"
        ],
        "type": "object"
      },
      "CheckInResponse": {
        "additionalProperties": false,
        "properties": {
          "status": {
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "CleanupView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": [
              "string",
              "null"
            ]
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "job_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "prune_deployments": {
            "type": "boolean"
          },
          "release_id": {
            "format": "uuid",
            "type": "string"
          },
          "remove_conversion_leftovers": {
            "type": "boolean"
          },
          "status": {
            "enum": [
              "pending",
              "succeeded",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "release_id",
          "job_id",
          "prune_deployments",
          "remove_conversion_leftovers",
          "status",
          "detail",
          "created_at",
          "finished_at"
        ],
        "type": "object"
      },
      "ClientMaintenanceView": {
        "additionalProperties": false,
        "properties": {
          "component": {
            "enum": [
              "pluspanel-os",
              "pluspanel-agent"
            ],
            "type": "string"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "reboot": {
            "description": "An OS update restarts the server once (a few minutes); an agent update does not interrupt sites.",
            "type": "boolean"
          },
          "scheduled_for": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "enum": [
              "scheduled",
              "in_progress",
              "done",
              "cancelled"
            ],
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "state",
          "component",
          "version",
          "scheduled_for",
          "finished_at",
          "reboot"
        ],
        "type": "object"
      },
      "CodeInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "code"
        ],
        "type": "object"
      },
      "ConvertStatus": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "leftovers_present": {
            "type": "boolean"
          },
          "outcome": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          }
        },
        "required": [
          "outcome",
          "reason",
          "leftovers_present"
        ],
        "type": "object"
      },
      "CreateAPIKeyInputBody": {
        "additionalProperties": false,
        "properties": {
          "expires_at": {
            "description": "Optional expiry (in the future).",
            "format": "date-time",
            "type": "string"
          },
          "ip_allowlist": {
            "description": "CIDRs or addresses; empty: anywhere.",
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "type": [
              "array",
              "null"
            ]
          },
          "kind": {
            "default": "personal",
            "description": "organization keys need apikeys.manage at the organization scope (admins).",
            "enum": [
              "personal",
              "organization"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "rate_limit_per_minute": {
            "description": "A limit below the edition's (600/min).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "scopes": {
            "description": "\u003cresource\u003e:read, \u003cresource\u003e:write, *:read or *.",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "scopes"
        ],
        "type": "object"
      },
      "CreateAccountInputBody": {
        "additionalProperties": false,
        "properties": {
          "inode_limit": {
            "description": "Deprecated raw limit: stored as an override, requires accounts.override.",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 0,
            "type": "integer"
          },
          "name": {
            "description": "Technical name, unique per server.",
            "pattern": "^[a-z][a-z0-9-]{1,30}$",
            "type": "string"
          },
          "overrides": {
            "$ref": "#/components/schemas/OverridesBody",
            "description": "Per-account exceptions to the plan; requires accounts.override."
          },
          "owner_user_id": {
            "description": "Admins: the reseller that will own the account. A reseller's accounts are always its own.",
            "format": "uuid",
            "type": "string"
          },
          "plan_id": {
            "description": "Hosting plan; absent = the organization's default plan.",
            "format": "uuid",
            "type": "string"
          },
          "quota_bytes": {
            "description": "Deprecated raw limit: stored as an override, requires accounts.override.",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateChannelInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig"
          },
          "enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "secret": {
            "$ref": "#/components/schemas/ChannelSecret"
          },
          "type": {
            "enum": [
              "email",
              "webhook",
              "slack",
              "discord",
              "telegram",
              "push"
            ],
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "config"
        ],
        "type": "object"
      },
      "CreateDBServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "engine": {
            "enum": [
              "mariadb",
              "postgres",
              "redis"
            ],
            "type": "string"
          },
          "name": {
            "description": "A name unique in the account.",
            "pattern": "^[a-z][a-z0-9-]{0,31}$",
            "type": "string"
          },
          "version": {
            "description": "A version of GET /db-versions that is not disabled; empty: the engine's default.",
            "type": "string"
          }
        },
        "required": [
          "name",
          "engine"
        ],
        "type": "object"
      },
      "CreateExportInputBody": {
        "additionalProperties": false,
        "properties": {
          "paths": {
            "description": "Snapshot paths (empty: the whole snapshot).",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "snapshot_id": {
            "pattern": "^[0-9a-f]{64}$",
            "type": "string"
          }
        },
        "required": [
          "snapshot_id"
        ],
        "type": "object"
      },
      "CreateIncidentInputBody": {
        "additionalProperties": false,
        "properties": {
          "body": {
            "description": "The first public note.",
            "maxLength": 2000,
            "minLength": 1,
            "type": "string"
          },
          "component": {
            "enum": [
              "control_plane",
              "mesh",
              "relay",
              "dns",
              "registry"
            ],
            "type": "string"
          },
          "impact": {
            "enum": [
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "state": {
            "default": "investigating",
            "enum": [
              "investigating",
              "identified",
              "monitoring",
              "resolved"
            ],
            "type": "string"
          },
          "title": {
            "maxLength": 200,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "title",
          "impact",
          "body"
        ],
        "type": "object"
      },
      "CreateMailDomainInputBody": {
        "additionalProperties": false,
        "properties": {
          "dmarc_policy": {
            "description": "Default quarantine.",
            "enum": [
              "none",
              "quarantine",
              "reject",
              ""
            ],
            "type": "string"
          },
          "mta_sts_mode": {
            "description": "Default testing.",
            "enum": [
              "none",
              "testing",
              "enforce",
              ""
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 253,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateMailboxInputBody": {
        "additionalProperties": false,
        "properties": {
          "display_name": {
            "maxLength": 128,
            "type": "string"
          },
          "local_part": {
            "maxLength": 64,
            "type": "string"
          },
          "login_enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "password": {
            "description": "A chosen password (policy-checked, sealed); absent: one is generated.",
            "maxLength": 128,
            "type": "string"
          },
          "quota_bytes": {
            "description": "Default: the plan's mailbox_quota_bytes (0 = unlimited).",
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "send_limit_per_hour": {
            "description": "Default: the plan's mail_send_limit_per_hour.",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "local_part"
        ],
        "type": "object"
      },
      "CreateRestoreInputBody": {
        "additionalProperties": false,
        "properties": {
          "alternate_path": {
            "description": "File-manager directory under /web/\u003csite\u003e/ or /restores/ (alternate paths only).",
            "maxLength": 1024,
            "type": "string"
          },
          "database": {
            "description": "kind database (MariaDB).",
            "maxLength": 64,
            "type": "string"
          },
          "kind": {
            "enum": [
              "account",
              "site",
              "db_service",
              "database",
              "paths",
              "mailbox"
            ],
            "type": "string"
          },
          "mailbox_id": {
            "description": "kind mailbox (M15): merged into its folder \"Restored \u003cdate\u003e\" (recreated first if deleted).",
            "type": "string"
          },
          "mode": {
            "default": "in_place",
            "description": "alternate: files land in /restores/\u003cid\u003e/ (or alternate_path), databases in a new service.",
            "enum": [
              "in_place",
              "alternate"
            ],
            "type": "string"
          },
          "paths": {
            "description": "kind paths: snapshot paths (files/…, db/…).",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "service_id": {
            "description": "kind db_service / database.",
            "type": "string"
          },
          "site_id": {
            "description": "kind site.",
            "type": "string"
          },
          "snapshot_id": {
            "pattern": "^[0-9a-f]{64}$",
            "type": "string"
          },
          "target_server_id": {
            "description": "A deleted account only: the server it comes back on (default its own).",
            "type": "string"
          }
        },
        "required": [
          "snapshot_id",
          "kind"
        ],
        "type": "object"
      },
      "CreateRolloutInputBody": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "description": "stable needs a completed preview rollout of the release (promotion).",
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "express": {
            "description": "Shorter observation periods (default: the release's kind).",
            "type": "boolean"
          },
          "max_parallel": {
            "description": "Servers updating at the same time (default 20).",
            "format": "int64",
            "maximum": 1000,
            "minimum": 1,
            "type": "integer"
          },
          "notify_lead_seconds": {
            "description": "How long before an update the client is told (default 24 h, express 1 h).",
            "format": "int64",
            "maximum": 604800,
            "minimum": 0,
            "type": "integer"
          },
          "observation_seconds": {
            "description": "Per ring; at least 300 unless every target is a lab server.",
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "maxItems": 5,
            "minItems": 5,
            "type": [
              "array",
              "null"
            ]
          },
          "release_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "release_id",
          "channel"
        ],
        "type": "object"
      },
      "CreateServerInputBody": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "description": "Release channel for agent + OS. Omitted: the organization's default channel, which the server then follows (M06e).",
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateServerOutputBody": {
        "additionalProperties": false,
        "properties": {
          "enrollment_token": {
            "description": "Placeholder: always null until the enrollment ceremony lands (M05).",
            "type": [
              "string",
              "null"
            ]
          },
          "server": {
            "$ref": "#/components/schemas/ServerView"
          }
        },
        "required": [
          "server",
          "enrollment_token"
        ],
        "type": "object"
      },
      "CreateSilenceInputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "UUID",
            "type": "string"
          },
          "comment": {
            "maxLength": 500,
            "minLength": 1,
            "type": "string"
          },
          "ends_at": {
            "format": "date-time",
            "type": "string"
          },
          "rule": {
            "maxLength": 64,
            "type": "string"
          },
          "server_id": {
            "description": "UUID",
            "type": "string"
          },
          "starts_at": {
            "description": "Default: now.",
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "ends_at",
          "comment"
        ],
        "type": "object"
      },
      "CreateUserInputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "Clients: the account to attach the user to (required for resellers).",
            "format": "uuid",
            "type": "string"
          },
          "display_name": {
            "maxLength": 200,
            "minLength": 1,
            "type": "string"
          },
          "email": {
            "format": "email",
            "maxLength": 254,
            "minLength": 3,
            "type": "string"
          },
          "locale": {
            "default": "en",
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "role": {
            "description": "Resellers invite clients only.",
            "enum": [
              "admin",
              "reseller",
              "client"
            ],
            "type": "string"
          },
          "role_in_account": {
            "default": "owner",
            "enum": [
              "owner",
              "collaborator"
            ],
            "type": "string"
          },
          "send_email": {
            "description": "Also email the link when SMTP is configured.",
            "type": "boolean"
          }
        },
        "required": [
          "email",
          "display_name",
          "role"
        ],
        "type": "object"
      },
      "CreateUserOutputBody": {
        "additionalProperties": false,
        "properties": {
          "invite": {
            "$ref": "#/components/schemas/OneTimeLink"
          },
          "user": {
            "$ref": "#/components/schemas/UserView"
          }
        },
        "required": [
          "user",
          "invite"
        ],
        "type": "object"
      },
      "CreateWebhookInputBody": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "maxLength": 200,
            "type": "string"
          },
          "enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "events": {
            "description": "Event patterns: *, \u003cresource\u003e.* (e.g. site.*) or an event type (GET /webhooks/event-types).",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "url": {
            "description": "HTTPS URL at a public address (checked again at every connection).",
            "maxLength": 2048,
            "minLength": 9,
            "type": "string"
          }
        },
        "required": [
          "url",
          "events"
        ],
        "type": "object"
      },
      "CreateZoneInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "The apex; IDNs are converted to A-labels.",
            "examples": [
              "example.com"
            ],
            "type": "string"
          },
          "status": {
            "description": "Default active. shadow: served but not delegated yet (imports awaiting cutover).",
            "enum": [
              "active",
              "shadow"
            ],
            "type": "string"
          },
          "template": {
            "$ref": "#/components/schemas/ZoneTemplateInput"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CredentialInputBody": {
        "additionalProperties": false,
        "properties": {
          "credential": {
            "description": "The PublicKeyCredential as JSON: id, rawId, type, response (base64url fields), clientExtensionResults."
          }
        },
        "required": [
          "credential"
        ],
        "type": "object"
      },
      "DBBindingView": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "env_prefix": {
            "type": "string"
          },
          "service_id": {
            "format": "uuid",
            "type": "string"
          },
          "site_id": {
            "format": "uuid",
            "type": "string"
          },
          "state": {
            "description": "broken: the service, database or user is gone; the site's container no longer carries the variables.",
            "enum": [
              "pending",
              "ok",
              "broken",
              "removing"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "user": {
            "type": "string"
          },
          "variables": {
            "description": "The variables injected into the site's web container.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "site_id",
          "service_id",
          "env_prefix",
          "database",
          "user",
          "state",
          "detail",
          "variables",
          "updated_at"
        ],
        "type": "object"
      },
      "DBDatabaseView": {
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "reported": {
            "description": "The agent's last inventory lists it.",
            "type": "boolean"
          },
          "tables": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "name",
          "bytes",
          "tables",
          "reported"
        ],
        "type": "object"
      },
      "DBDumpInputBody": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "description": "The database (redis: empty or 0).",
            "type": "string"
          }
        },
        "type": "object"
      },
      "DBEngineVersionListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DBEngineVersionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DBEngineVersionView": {
        "additionalProperties": false,
        "properties": {
          "catalog_image": {
            "examples": [
              "mariadb"
            ],
            "type": "string"
          },
          "engine": {
            "enum": [
              "mariadb",
              "postgres",
              "redis"
            ],
            "type": "string"
          },
          "is_default": {
            "description": "The version new services of the engine get.",
            "type": "boolean"
          },
          "note": {
            "type": "string"
          },
          "status": {
            "description": "deprecated: still selectable; disabled: not selectable (services already on it keep it).",
            "enum": [
              "supported",
              "deprecated",
              "disabled"
            ],
            "type": "string"
          },
          "version": {
            "examples": [
              "12.3"
            ],
            "type": "string"
          }
        },
        "required": [
          "engine",
          "version",
          "catalog_image",
          "status",
          "is_default",
          "note"
        ],
        "type": "object"
      },
      "DBNameInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "1-63 characters of a-z, 0-9 and _ starting with a letter; not reserved.",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "DBServiceActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "description": "Poll GET /jobs/{id}.",
            "format": "uuid",
            "type": "string"
          },
          "service": {
            "$ref": "#/components/schemas/DBServiceView"
          }
        },
        "required": [
          "service"
        ],
        "type": "object"
      },
      "DBServiceListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DBServiceView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DBServiceView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "bindings": {
            "items": {
              "$ref": "#/components/schemas/DBBindingView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "busy": {
            "description": "A mutating job of the service is in flight.",
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "databases": {
            "items": {
              "$ref": "#/components/schemas/DBDatabaseView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "detail": {
            "type": "string"
          },
          "engine": {
            "enum": [
              "mariadb",
              "postgres",
              "redis"
            ],
            "type": "string"
          },
          "engine_version": {
            "description": "What the engine itself reports, e.g. 12.3.3.",
            "type": "string"
          },
          "host": {
            "description": "The service's name on the account network.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_dump_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "last_dump_file": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "parked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "parked_reason": {
            "enum": [
              "",
              "idle",
              "explicit"
            ],
            "type": "string"
          },
          "pma_sessions": {
            "items": {
              "$ref": "#/components/schemas/PMASessionView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "enum": [
              "provisioning",
              "running",
              "parked",
              "upgrading",
              "failed",
              "removing",
              "removed"
            ],
            "type": "string"
          },
          "target_version": {
            "description": "The version a running change goes to (empty otherwise).",
            "type": "string"
          },
          "users": {
            "items": {
              "$ref": "#/components/schemas/DBUserView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "version": {
            "type": "string"
          },
          "version_error": {
            "description": "Why the last version change failed (it was rolled back unless status is failed).",
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "server_id",
          "name",
          "engine",
          "version",
          "target_version",
          "status",
          "parked_reason",
          "parked_at",
          "detail",
          "version_error",
          "engine_version",
          "host",
          "port",
          "last_dump_at",
          "last_dump_file",
          "reported_at",
          "busy",
          "databases",
          "users",
          "bindings",
          "pma_sessions",
          "created_at"
        ],
        "type": "object"
      },
      "DBTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "idle_fast_forward_seconds": {
            "description": "Move the automatic parking's idle clock forward (0: off).",
            "format": "int32",
            "maximum": 2592000,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "idle_fast_forward_seconds"
        ],
        "type": "object"
      },
      "DBUserInputBody": {
        "additionalProperties": false,
        "properties": {
          "databases": {
            "description": "The databases the user gets all privileges on (exactly these; empty for redis). The password is generated on the server and never leaves it: bind the user to a site to use it.",
            "items": {
              "type": "string"
            },
            "maxItems": 64,
            "type": [
              "array",
              "null"
            ]
          },
          "name": {
            "description": "1-32 characters of a-z, 0-9 and _ starting with a letter; not reserved.",
            "type": "string"
          }
        },
        "required": [
          "name",
          "databases"
        ],
        "type": "object"
      },
      "DBUserView": {
        "additionalProperties": false,
        "properties": {
          "databases": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "reported": {
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "databases",
          "reported"
        ],
        "type": "object"
      },
      "DBVersionInputBody": {
        "additionalProperties": false,
        "properties": {
          "force_failure": {
            "description": "Drill hook: the sanity check after the upgrade fails so the rollback runs. Lab servers and holders of jobs.test_probes only (403 otherwise).",
            "type": "boolean"
          },
          "version": {
            "description": "A higher version of the same engine (downgrades are refused: restore a backup instead).",
            "type": "string"
          }
        },
        "required": [
          "version"
        ],
        "type": "object"
      },
      "DNS01OrderView": {
        "additionalProperties": false,
        "properties": {
          "attempts": {
            "format": "int32",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "job_id": {
            "description": "The import job that delivers the certificate (succeeded orders).",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "names": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": "string"
          },
          "production": {
            "type": "boolean"
          },
          "reason": {
            "enum": [
              "policy",
              "renewal",
              "manual"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "running",
              "succeeded",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "reason",
          "names",
          "production",
          "attempts",
          "error",
          "next_attempt_at",
          "job_id",
          "created_at",
          "finished_at"
        ],
        "type": "object"
      },
      "DeleteAccountOutputBody": {
        "additionalProperties": false,
        "properties": {
          "account": {
            "$ref": "#/components/schemas/AccountView",
            "description": "Step 2 only: the account, now in status removing."
          },
          "confirm_token": {
            "description": "Step 1 only: single-use token, valid 10 minutes, shown once.",
            "type": "string"
          },
          "expires_at": {
            "description": "Step 1 only: token expiry.",
            "format": "date-time",
            "type": "string"
          }
        },
        "type": "object"
      },
      "DeleteUserOutputBody": {
        "additionalProperties": false,
        "properties": {
          "confirm_token": {
            "description": "Step 1 only: single-use token, valid 10 minutes, shown once.",
            "type": "string"
          },
          "expires_at": {
            "description": "Step 1 only.",
            "format": "date-time",
            "type": "string"
          },
          "user": {
            "$ref": "#/components/schemas/UserView",
            "description": "Step 2 only: the pseudonymized user."
          }
        },
        "type": "object"
      },
      "DeliveriesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DeliveryView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DeliveryView": {
        "additionalProperties": false,
        "properties": {
          "attempts": {
            "format": "int64",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "alert",
              "test"
            ],
            "type": "string"
          },
          "last_error": {
            "type": "string"
          },
          "next_at": {
            "format": "date-time",
            "type": "string"
          },
          "response_code": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "sent_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "sent",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "kind",
          "status",
          "attempts",
          "next_at",
          "last_error",
          "response_code",
          "created_at",
          "sent_at"
        ],
        "type": "object"
      },
      "DeployServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "catalog_image": {
            "description": "Catalog image (GET /catalog).",
            "enum": [
              "nginx-static",
              "php-ols"
            ],
            "type": "string"
          },
          "env": {
            "description": "Environment variables (at most 32, unique names).",
            "items": {
              "$ref": "#/components/schemas/ServiceEnvVar"
            },
            "maxItems": 32,
            "type": [
              "array",
              "null"
            ]
          },
          "mounts_profile": {
            "description": "Omitted: the catalog image's default profile.",
            "enum": [
              "static",
              "php"
            ],
            "type": "string"
          },
          "name": {
            "description": "Service name, unique in the account among services that are not removed.",
            "pattern": "^[a-z][a-z0-9-]{0,30}$",
            "type": "string"
          }
        },
        "required": [
          "name",
          "catalog_image"
        ],
        "type": "object"
      },
      "DeviceCodeInputBody": {
        "additionalProperties": false,
        "properties": {
          "client_name": {
            "description": "Shown to the person approving, e.g. \"pluspanel CLI on laptop\".",
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "client_name"
        ],
        "type": "object"
      },
      "DeviceCodeOutputBody": {
        "additionalProperties": false,
        "properties": {
          "device_code": {
            "description": "Secret: the CLI polls POST /auth/device/token with it. Stored only as SHA-256.",
            "type": "string"
          },
          "expires_in": {
            "description": "Seconds the codes are valid (600).",
            "format": "int64",
            "type": "integer"
          },
          "interval": {
            "description": "Seconds to wait between polls (5).",
            "format": "int64",
            "type": "integer"
          },
          "user_code": {
            "description": "The person enters or confirms it in the panel.",
            "examples": [
              "BCDF-GHJK"
            ],
            "type": "string"
          },
          "verification_uri": {
            "examples": [
              "https://panel.example.com/device"
            ],
            "type": "string"
          },
          "verification_uri_complete": {
            "examples": [
              "https://panel.example.com/device?code=BCDF-GHJK"
            ],
            "type": "string"
          }
        },
        "required": [
          "device_code",
          "user_code",
          "verification_uri",
          "verification_uri_complete",
          "expires_in",
          "interval"
        ],
        "type": "object"
      },
      "DeviceRequestView": {
        "additionalProperties": false,
        "properties": {
          "client_ip": {
            "type": [
              "string",
              "null"
            ]
          },
          "client_name": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "approved",
              "denied",
              "consumed",
              "expired"
            ],
            "type": "string"
          },
          "user_code": {
            "type": "string"
          }
        },
        "required": [
          "user_code",
          "client_name",
          "client_ip",
          "created_at",
          "expires_at",
          "status"
        ],
        "type": "object"
      },
      "DeviceTokenInputBody": {
        "additionalProperties": false,
        "properties": {
          "device_code": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "device_code"
        ],
        "type": "object"
      },
      "DeviceTokenOutputBody": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "$ref": "#/components/schemas/APIKeyView"
          },
          "tenant": {
            "$ref": "#/components/schemas/TenantStruct"
          },
          "token": {
            "description": "The API key token, shown once.",
            "type": "string"
          },
          "user": {
            "$ref": "#/components/schemas/UserStruct"
          }
        },
        "required": [
          "token",
          "key",
          "tenant",
          "user"
        ],
        "type": "object"
      },
      "EditionView": {
        "additionalProperties": false,
        "properties": {
          "edition": {
            "description": "Effective edition (the license caps it in licensed mode).",
            "enum": [
              "free",
              "pro",
              "enterprise"
            ],
            "type": "string"
          },
          "features": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "license": {
            "$ref": "#/components/schemas/LicenseView"
          },
          "limits": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "description": "-1 = unlimited.",
            "type": "object"
          },
          "mode": {
            "enum": [
              "saas",
              "licensed"
            ],
            "type": "string"
          },
          "tenant_edition": {
            "description": "The organization's own edition.",
            "enum": [
              "free",
              "pro",
              "enterprise"
            ],
            "type": "string"
          },
          "usage": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "type": "object"
          }
        },
        "required": [
          "edition",
          "tenant_edition",
          "features",
          "limits",
          "usage",
          "mode"
        ],
        "type": "object"
      },
      "EnqueueJobInputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "storage_probe / runtime_probe: account UUID of this server (optional for the host-level actions check_outside, selinux_audit and egress_counters).",
            "type": "string"
          },
          "action": {
            "description": "storage_probe: fill_bytes, fill_inodes, clear, check_outside, selinux_audit (check_outside and selinux_audit are host-level; selinux_audit is read-only). runtime_probe (M08-core acceptance drills, agent ADR-0002 §8): processes, http_get, connect, exec_tmp, write_outside, memory_hog, fork_bomb, fill_bytes, clear_fill, put_web_file, egress_counters.",
            "enum": [
              "fill_bytes",
              "fill_inodes",
              "clear",
              "check_outside",
              "selinux_audit",
              "processes",
              "http_get",
              "connect",
              "exec_tmp",
              "write_outside",
              "memory_hog",
              "fork_bomb",
              "clear_fill",
              "put_web_file",
              "egress_counters"
            ],
            "type": "string"
          },
          "amount": {
            "description": "runtime_probe fill_bytes: bytes to write to /tmp; fork_bomb: processes to start (at most 4096).",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "bytes": {
            "description": "storage_probe fill_bytes: bytes to try to write.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "command_type": {
            "description": "Allowlisted command type.",
            "enum": [
              "noop",
              "ping",
              "rotate_wireguard_key",
              "apply_os_update",
              "rollback_os",
              "storage_probe",
              "runtime_probe"
            ],
            "type": "string"
          },
          "content": {
            "description": "runtime_probe put_web_file: file content, at most 64 KiB.",
            "maxLength": 65536,
            "type": "string"
          },
          "echo": {
            "description": "Text echoed back by a noop job.",
            "maxLength": 256,
            "type": "string"
          },
          "expected_digest": {
            "description": "apply_os_update: the image manifest digest to boot, sha256:\u003chex\u003e.",
            "maxLength": 71,
            "type": "string"
          },
          "file_name": {
            "description": "runtime_probe put_web_file: file name directly under web/ (.htaccess, or [A-Za-z0-9][A-Za-z0-9._-]{0,63}).",
            "maxLength": 64,
            "type": "string"
          },
          "host": {
            "description": "runtime_probe http_get: Host header to send (M08-wp).",
            "maxLength": 253,
            "type": "string"
          },
          "image_ref": {
            "description": "apply_os_update: the distribution repository (no tag), e.g. registry.pluspanel.net/pluspanel-os.",
            "maxLength": 255,
            "type": "string"
          },
          "inodes": {
            "description": "storage_probe fill_inodes: empty files to try to create.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "max_attempts": {
            "description": "Delivery attempts before dead-lettering (default 5).",
            "format": "int32",
            "maximum": 20,
            "minimum": 1,
            "type": "integer"
          },
          "priority": {
            "description": "Higher runs first.",
            "format": "int32",
            "maximum": 100,
            "minimum": -100,
            "type": "integer"
          },
          "reboot_delay_seconds": {
            "description": "OS updates: seconds between staging and the reboot (0 = right after reporting).",
            "format": "int32",
            "maximum": 86400,
            "minimum": 0,
            "type": "integer"
          },
          "service_name": {
            "description": "runtime_probe: service of the account (every action except egress_counters and put_web_file).",
            "maxLength": 31,
            "type": "string"
          },
          "site": {
            "description": "runtime_probe put_web_file: WordPress site key (12 lower-case hex digits) to write into web/\u003csite\u003e/ instead of web/ (M08-wp).",
            "maxLength": 12,
            "type": "string"
          },
          "target": {
            "description": "runtime_probe connect: host:port to connect to from inside the container; http_get: optional path (default /).",
            "maxLength": 255,
            "type": "string"
          }
        },
        "required": [
          "command_type"
        ],
        "type": "object"
      },
      "EnrollmentTokenOutputBody": {
        "additionalProperties": false,
        "properties": {
          "ca_bundle_pem": {
            "description": "Intermediate + root CA certificates the agent must trust.",
            "type": "string"
          },
          "enrollment_url": {
            "description": "Base URL of the enrollment listener (POST {url}/enroll).",
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "token": {
            "description": "One-time enrollment token (shown once; valid 15 minutes).",
            "type": "string"
          }
        },
        "required": [
          "server_id",
          "token",
          "expires_at",
          "enrollment_url",
          "ca_bundle_pem"
        ],
        "type": "object"
      },
      "ErrorBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "Stable machine-readable error code.",
            "type": "string"
          },
          "message": {
            "description": "Human-readable description (English).",
            "type": "string"
          },
          "organizations": {
            "items": {
              "$ref": "#/components/schemas/OrganizationChoice"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "request_id": {
            "description": "Correlates with server logs.",
            "type": "string"
          }
        },
        "required": [
          "code",
          "message",
          "request_id"
        ],
        "type": "object"
      },
      "ExitReportView": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "boot_id": {
            "type": "string"
          },
          "exit_code": {
            "type": "string"
          },
          "exit_status": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "journal": {
            "description": "Only on GET /servers/{id}/exit-reports/{rid}.",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "received_at": {
            "format": "date-time",
            "type": "string"
          },
          "result": {
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "uptime_seconds": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "server_id",
          "name",
          "at",
          "boot_id",
          "uptime_seconds",
          "result",
          "exit_code",
          "exit_status",
          "received_at"
        ],
        "type": "object"
      },
      "FileOperationInputBody": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "contentEncoding": "base64",
            "description": "base64; at most 2 MiB",
            "type": "string"
          },
          "create_only": {
            "type": "boolean"
          },
          "expected_mtime_ns": {
            "format": "int64",
            "type": "integer"
          },
          "format": {
            "enum": [
              "zip",
              "tar.gz",
              ""
            ],
            "type": "string"
          },
          "limit": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_bytes": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "mode": {
            "description": "permission bits, e.g. 420 (0644)",
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "offset": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "op": {
            "enum": [
              "list",
              "stat",
              "read",
              "write",
              "delete",
              "move",
              "copy",
              "mkdir",
              "chmod",
              "archive",
              "unarchive"
            ],
            "type": "string"
          },
          "overwrite": {
            "type": "boolean"
          },
          "parents": {
            "type": "boolean"
          },
          "path": {
            "maxLength": 4096,
            "type": "string"
          },
          "paths": {
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "recursive": {
            "type": "boolean"
          },
          "to": {
            "maxLength": 4096,
            "type": "string"
          }
        },
        "required": [
          "op"
        ],
        "type": "object"
      },
      "Finding": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "day": {
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "event_id": {
            "format": "int64",
            "type": "integer"
          },
          "observed": {
            "type": "string"
          },
          "seq": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "code",
          "seq",
          "detail"
        ],
        "type": "object"
      },
      "FirewallRuleBody": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "description": "allow: when a service has allow rules, only their prefixes reach it; deny: drop.",
            "enum": [
              "allow",
              "deny"
            ],
            "type": "string"
          },
          "cidr": {
            "description": "IPv4 or IPv6 prefix (a bare address is a /32 or /128); host bits must be zero.",
            "maxLength": 64,
            "type": "string"
          },
          "note": {
            "maxLength": 200,
            "type": "string"
          },
          "service": {
            "description": "http: ports 80/443; sftp: 2222; all: every workload service.",
            "enum": [
              "all",
              "http",
              "sftp"
            ],
            "type": "string"
          }
        },
        "required": [
          "action",
          "cidr",
          "service"
        ],
        "type": "object"
      },
      "FirewallView": {
        "additionalProperties": false,
        "properties": {
          "applied_sha256": {
            "type": "string"
          },
          "crs_version": {
            "type": "string"
          },
          "desired_sha256": {
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "geo_countries": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "geo_db_version": {
            "type": "string"
          },
          "in_sync": {
            "type": "boolean"
          },
          "input_policy_drop": {
            "type": "boolean"
          },
          "listening": {
            "items": {
              "$ref": "#/components/schemas/ListeningPortView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "no_inbound_management": {
            "description": "Confirmed by the agent: no management service accepts inbound connections.",
            "type": "boolean"
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "rule_count": {
            "format": "int32",
            "type": "integer"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "supported": {
            "type": "boolean"
          },
          "waf_engine": {
            "type": "string"
          }
        },
        "required": [
          "server_id",
          "supported",
          "reported_at",
          "no_inbound_management",
          "input_policy_drop",
          "rule_count",
          "listening",
          "waf_engine",
          "crs_version",
          "geo_db_version",
          "geo_countries",
          "detail",
          "applied_sha256",
          "desired_sha256",
          "in_sync"
        ],
        "type": "object"
      },
      "FiringCounts": {
        "additionalProperties": false,
        "properties": {
          "critical": {
            "format": "int64",
            "type": "integer"
          },
          "warning": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "critical",
          "warning"
        ],
        "type": "object"
      },
      "FleetFSView": {
        "additionalProperties": false,
        "properties": {
          "avail_bytes": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "fs": {
            "enum": [
              "root",
              "storage",
              "obs"
            ],
            "type": "string"
          },
          "inodes_used_ratio": {
            "format": "double",
            "type": "number"
          },
          "size_bytes": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "used_ratio": {
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "fs",
          "size_bytes",
          "avail_bytes",
          "used_ratio",
          "inodes_used_ratio"
        ],
        "type": "object"
      },
      "FleetOutputBody": {
        "additionalProperties": false,
        "properties": {
          "servers": {
            "items": {
              "$ref": "#/components/schemas/FleetServerView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "servers"
        ],
        "type": "object"
      },
      "FleetServerView": {
        "additionalProperties": false,
        "properties": {
          "config_hash": {
            "type": "string"
          },
          "config_in_sync": {
            "description": "The agent runs the desired telemetry configuration.",
            "type": "boolean"
          },
          "cpu_busy": {
            "description": "0..1.",
            "format": "double",
            "type": "number"
          },
          "cpus": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "desired_config_hash": {
            "type": "string"
          },
          "disk_used_ratio": {
            "description": "The fullest monitored filesystem.",
            "format": "double",
            "type": "number"
          },
          "errors": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "filesystems": {
            "items": {
              "$ref": "#/components/schemas/FleetFSView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "firing": {
            "$ref": "#/components/schemas/FiringCounts",
            "description": "Firing alerts of the server by severity."
          },
          "health": {
            "description": "offline (no contact), else the worst firing alert, else ok; unknown = no telemetry.",
            "enum": [
              "offline",
              "critical",
              "warning",
              "ok",
              "unknown"
            ],
            "type": "string"
          },
          "last_seen_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "load1": {
            "format": "double",
            "type": "number"
          },
          "mem_used_ratio": {
            "format": "double",
            "type": "number"
          },
          "name": {
            "type": "string"
          },
          "online": {
            "description": "Contact within the last 2 minutes.",
            "type": "boolean"
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "revoked": {
            "type": "boolean"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "settings": {
            "$ref": "#/components/schemas/ServerTelemetryCfg"
          },
          "stores": {
            "format": "int64",
            "type": "integer"
          },
          "stores_up": {
            "format": "int64",
            "type": "integer"
          },
          "telemetry_supported": {
            "description": "The agent reports Heartbeat.telemetry.",
            "type": "boolean"
          }
        },
        "required": [
          "server_id",
          "name",
          "health",
          "firing",
          "online",
          "revoked",
          "last_seen_at",
          "telemetry_supported",
          "reported_at",
          "cpu_busy",
          "cpus",
          "load1",
          "mem_used_ratio",
          "disk_used_ratio",
          "filesystems",
          "stores",
          "stores_up",
          "errors",
          "config_in_sync",
          "settings",
          "config_hash",
          "desired_config_hash"
        ],
        "type": "object"
      },
      "ForceBackupTestInputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "Test this account (default: a random one).",
            "type": "string"
          }
        },
        "type": "object"
      },
      "GateView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "name": {
            "enum": [
              "verification",
              "reconnect",
              "online",
              "sites",
              "agent_exits",
              "resources",
              "jobs"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "pass",
              "pending",
              "fail"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "status"
        ],
        "type": "object"
      },
      "GeoIPOutputBody": {
        "additionalProperties": false,
        "properties": {
          "attribution": {
            "$ref": "#/components/schemas/AttributionView"
          },
          "countries": {
            "description": "Every selectable ISO 3166-1 alpha-2 code.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "imported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "version": {
            "description": "Current database version (empty: none imported; country rules answer 409 geoip_unavailable).",
            "type": "string"
          }
        },
        "required": [
          "version",
          "imported_at",
          "countries",
          "attribution"
        ],
        "type": "object"
      },
      "GrantView": {
        "additionalProperties": false,
        "properties": {
          "granted_at": {
            "format": "date-time",
            "type": "string"
          },
          "granted_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "permission": {
            "enum": [
              "jobs.test_probes"
            ],
            "type": "string"
          }
        },
        "required": [
          "permission",
          "granted_by",
          "granted_at"
        ],
        "type": "object"
      },
      "HealthBody": {
        "additionalProperties": false,
        "properties": {
          "status": {
            "enum": [
              "ok"
            ],
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "IMAPStruct": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "maxLength": 253,
            "type": "string"
          },
          "implicit_tls": {
            "type": "boolean"
          },
          "password": {
            "description": "Sealed to the server's key; never stored.",
            "maxLength": 1024,
            "type": "string"
          },
          "port": {
            "format": "int32",
            "maximum": 65535,
            "minimum": 1,
            "type": "integer"
          },
          "username": {
            "maxLength": 256,
            "type": "string"
          }
        },
        "required": [
          "host",
          "port",
          "implicit_tls",
          "username",
          "password"
        ],
        "type": "object"
      },
      "ImpersonationView": {
        "additionalProperties": false,
        "properties": {
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "real_user": {
            "$ref": "#/components/schemas/UserView"
          },
          "reason": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "real_user",
          "expires_at",
          "reason"
        ],
        "type": "object"
      },
      "ImportSiteCertificateInputBody": {
        "additionalProperties": false,
        "properties": {
          "cert_pem": {
            "description": "Leaf certificate, PEM (may be followed by its chain), at most 64 KiB.",
            "type": "string"
          },
          "chain_pem": {
            "description": "Intermediate certificates, PEM, at most 64 KiB; may be empty.",
            "type": "string"
          },
          "key_pem": {
            "description": "Private key, PEM (PKCS#8, PKCS#1 or SEC 1; not encrypted), at most 16 KiB. RSA 2048-8192 or ECDSA P-256/P-384. Never logged, audited or kept after the job ends.",
            "type": "string"
          }
        },
        "required": [
          "cert_pem",
          "key_pem"
        ],
        "type": "object"
      },
      "IncidentView": {
        "additionalProperties": false,
        "properties": {
          "automatic": {
            "type": "boolean"
          },
          "component": {
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "impact": {
            "enum": [
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "resolved_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "started_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "investigating",
              "identified",
              "monitoring",
              "resolved"
            ],
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "updates": {
            "items": {
              "$ref": "#/components/schemas/StatusIncidentNote"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "component",
          "title",
          "state",
          "impact",
          "automatic",
          "started_at",
          "resolved_at",
          "updates"
        ],
        "type": "object"
      },
      "IncidentsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/IncidentView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "IngressStatusView": {
        "additionalProperties": false,
        "properties": {
          "config_sha256": {
            "description": "SHA-256 of the loaded configuration.",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "image_digest": {
            "type": "string"
          },
          "reloaded_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "routes": {
            "description": "Number of routed sites.",
            "format": "int32",
            "type": "integer"
          },
          "state": {
            "enum": [
              "unspecified",
              "running",
              "degraded",
              "absent"
            ],
            "type": "string"
          }
        },
        "required": [
          "state",
          "image_digest",
          "routes",
          "config_sha256",
          "reloaded_at",
          "detail",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "JobAcceptedBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "type": "string"
          }
        },
        "required": [
          "job_id"
        ],
        "type": "object"
      },
      "JobAcceptedOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "description": "Poll GET /jobs/{id}.",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "job_id"
        ],
        "type": "object"
      },
      "JobIDOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "description": "Poll GET /jobs/{id}.",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "job_id"
        ],
        "type": "object"
      },
      "JobView": {
        "additionalProperties": false,
        "properties": {
          "attempts": {
            "format": "int32",
            "type": "integer"
          },
          "command_type": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by_user_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "dispatched_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_error": {
            "type": [
              "string",
              "null"
            ]
          },
          "max_attempts": {
            "format": "int32",
            "type": "integer"
          },
          "os_update": {
            "$ref": "#/components/schemas/OSUpdateView",
            "description": "OS update tracking (apply_os_update, rollback_os): confirmed only when the agent reconnects on the staged image."
          },
          "priority": {
            "format": "int32",
            "type": "integer"
          },
          "result": {
            "additionalProperties": {},
            "description": "Agent-reported outcome (status, error_code, output, timestamps).",
            "type": [
              "object",
              "null"
            ]
          },
          "scheduled_at": {
            "format": "date-time",
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "leased",
              "dispatched",
              "acked",
              "succeeded",
              "failed",
              "dead",
              "cancelled"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "server_id",
          "command_type",
          "status",
          "priority",
          "attempts",
          "max_attempts",
          "scheduled_at",
          "dispatched_at",
          "created_at",
          "updated_at",
          "created_by_user_id",
          "last_error",
          "result"
        ],
        "type": "object"
      },
      "JoinWaitlistInputBody": {
        "additionalProperties": false,
        "properties": {
          "consent": {
            "description": "Explicit GDPR consent; must be true.",
            "type": "boolean"
          },
          "email": {
            "description": "Where to send the launch notification.",
            "format": "email",
            "maxLength": 254,
            "minLength": 3,
            "type": "string"
          },
          "locale": {
            "description": "Language of the page the visitor used.",
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "name": {
            "description": "Optional display name.",
            "maxLength": 100,
            "type": "string"
          },
          "website": {
            "description": "Honeypot. Must be empty; a filled value is accepted and silently dropped.",
            "maxLength": 200,
            "type": "string"
          }
        },
        "required": [
          "email",
          "locale",
          "consent"
        ],
        "type": "object"
      },
      "JoinWaitlistOutputBody": {
        "additionalProperties": false,
        "properties": {
          "status": {
            "enum": [
              "ok"
            ],
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "LaunchSiteInputBody": {
        "additionalProperties": false,
        "properties": {
          "admin_email": {
            "description": "E-mail of the WordPress administrator.",
            "type": "string"
          },
          "admin_user": {
            "description": "Administrator login, [A-Za-z0-9._-]{3,32}; default pluspanel-admin.",
            "type": "string"
          },
          "aliases": {
            "description": "Additional host names (same rules as primary_domain), at most 20, unique on the server.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "locale": {
            "description": "WordPress locale such as en_US or ro_RO; default en_US.",
            "type": "string"
          },
          "php_version": {
            "description": "A version of GET /php-versions that is not disabled; default: the default version.",
            "type": "string"
          },
          "plugin_set_id": {
            "description": "A plugin set of the tenant (GET /plugin-sets); default: the tenant's default set.",
            "format": "uuid",
            "type": "string"
          },
          "primary_domain": {
            "description": "Host name, unique per server. Trimmed, lower-cased and converted to its IDNA A-label (bücher.de → xn--bcher-kva.de); then letters, digits and hyphens, at least two labels, at most 253 bytes. No wildcard, IP address, port, localhost or .invalid name.",
            "type": "string"
          },
          "title": {
            "description": "Printable UTF-8, 1 to 128 bytes.",
            "type": "string"
          }
        },
        "required": [
          "primary_domain",
          "title",
          "admin_email"
        ],
        "type": "object"
      },
      "LicenseView": {
        "additionalProperties": false,
        "properties": {
          "checked_at": {
            "format": "date-time",
            "type": "string"
          },
          "edition": {
            "type": "string"
          },
          "grace_days_left": {
            "description": "Started days of grace left (14 on the expiry day, 1 on the last); 0 outside the grace period.",
            "format": "int64",
            "type": "integer"
          },
          "grace_ends_at": {
            "description": "not_after + 14 days: when an expired license stops granting its edition.",
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_error": {
            "type": "string"
          },
          "licensee": {
            "type": "string"
          },
          "max_servers": {
            "format": "int64",
            "type": "integer"
          },
          "not_after": {
            "format": "date-time",
            "type": "string"
          },
          "server_count": {
            "description": "Servers on the whole installation.",
            "format": "int64",
            "type": "integer"
          },
          "state": {
            "description": "valid; grace = expired less than 14 days ago, the edition still applies; expired = Free; revoked = Free at once (ADR-0011 §2.1).",
            "enum": [
              "valid",
              "grace",
              "expired",
              "revoked"
            ],
            "type": "string"
          },
          "status": {
            "description": "Last answer of the license server; check-ins fail open.",
            "enum": [
              "pending",
              "valid",
              "revoked",
              "unknown"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "licensee",
          "edition",
          "max_servers",
          "not_after",
          "state",
          "grace_ends_at",
          "grace_days_left",
          "status",
          "server_count"
        ],
        "type": "object"
      },
      "ListeningPortView": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "type": "string"
          },
          "exposed": {
            "description": "Reachable from outside through the firewall.",
            "type": "boolean"
          },
          "port": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "protocol": {
            "type": "string"
          },
          "service": {
            "description": "http, sftp, wireguard or empty (unknown).",
            "type": "string"
          }
        },
        "required": [
          "protocol",
          "address",
          "port",
          "service",
          "exposed"
        ],
        "type": "object"
      },
      "LogLineView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "fields": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "kind": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "server_id": {
            "type": "string"
          },
          "site_id": {
            "type": "string"
          },
          "time": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "time",
          "kind",
          "message"
        ],
        "type": "object"
      },
      "LoginBanView": {
        "additionalProperties": false,
        "properties": {
          "active": {
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "failures": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "ip": {
            "type": "string"
          },
          "lifted_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "ip",
          "failures",
          "created_at",
          "expires_at",
          "lifted_at",
          "active"
        ],
        "type": "object"
      },
      "LoginBansOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/LoginBanView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "LoginInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "format": "email",
            "maxLength": 254,
            "minLength": 3,
            "type": "string"
          },
          "password": {
            "maxLength": 256,
            "minLength": 1,
            "type": "string"
          },
          "tenant": {
            "description": "Organization slug, optional: on a panel host owned by an organization it is that one; elsewhere the organization is found from the email after a correct password (409 organization_required lists the choices when several match).",
            "maxLength": 63,
            "pattern": "^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)?$",
            "type": "string"
          }
        },
        "required": [
          "email",
          "password"
        ],
        "type": "object"
      },
      "LogsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "cursor": {
            "description": "Next page (older lines); empty at the end.",
            "type": "string"
          },
          "lines": {
            "items": {
              "$ref": "#/components/schemas/LogLineView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "source": {
            "enum": [
              "central",
              "local"
            ],
            "type": "string"
          }
        },
        "required": [
          "lines",
          "cursor",
          "source"
        ],
        "type": "object"
      },
      "MFACodeInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "code"
        ],
        "type": "object"
      },
      "MFAStatusBody": {
        "additionalProperties": false,
        "properties": {
          "mfa_pending": {
            "description": "This session waits for a factor to be enrolled.",
            "type": "boolean"
          },
          "mfa_required": {
            "description": "The organization's policy requires a second factor of this user.",
            "type": "boolean"
          },
          "passkeys": {
            "format": "int64",
            "type": "integer"
          },
          "recovery_codes_remaining": {
            "format": "int64",
            "type": "integer"
          },
          "rp_id": {
            "description": "The RP ID passkeys use on this address; null: passkeys are not available here.",
            "type": [
              "string",
              "null"
            ]
          },
          "totp_enabled": {
            "type": "boolean"
          },
          "totp_pending": {
            "description": "An enrollment was started and waits for its first code.",
            "type": "boolean"
          }
        },
        "required": [
          "totp_enabled",
          "totp_pending",
          "passkeys",
          "recovery_codes_remaining",
          "mfa_required",
          "mfa_pending",
          "rp_id"
        ],
        "type": "object"
      },
      "MailAliasActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "alias": {
            "$ref": "#/components/schemas/MailAliasView"
          },
          "job_id": {
            "type": "string"
          }
        },
        "required": [
          "alias",
          "job_id"
        ],
        "type": "object"
      },
      "MailAliasInputBody": {
        "additionalProperties": false,
        "properties": {
          "local_part": {
            "maxLength": 64,
            "type": "string"
          },
          "targets": {
            "description": "Mailbox ids of the same account.",
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "local_part",
          "targets"
        ],
        "type": "object"
      },
      "MailAliasListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/MailAliasView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "MailAliasTargetView": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "type": "string"
          },
          "mailbox_id": {
            "type": "string"
          }
        },
        "required": [
          "mailbox_id",
          "address"
        ],
        "type": "object"
      },
      "MailAliasView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "address": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "domain_id": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "local_part": {
            "type": "string"
          },
          "state": {
            "enum": [
              "pending",
              "active",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "targets": {
            "items": {
              "$ref": "#/components/schemas/MailAliasTargetView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "domain_id",
          "account_id",
          "address",
          "local_part",
          "targets",
          "state",
          "created_at"
        ],
        "type": "object"
      },
      "MailAutoresponderView": {
        "additionalProperties": false,
        "properties": {
          "body": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "ends_at": {
            "format": "date-time",
            "type": "string"
          },
          "interval_hours": {
            "format": "int32",
            "type": "integer"
          },
          "starts_at": {
            "format": "date-time",
            "type": "string"
          },
          "subject": {
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "subject",
          "body",
          "interval_hours"
        ],
        "type": "object"
      },
      "MailClientEndpoint": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "enum": [
              "imap",
              "smtp"
            ],
            "type": "string"
          },
          "security": {
            "enum": [
              "ssl",
              "starttls"
            ],
            "type": "string"
          }
        },
        "required": [
          "protocol",
          "host",
          "port",
          "security"
        ],
        "type": "object"
      },
      "MailClientSettings": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "type": "string"
          },
          "autoconfig_url": {
            "description": "Thunderbird-style autoconfiguration.",
            "type": "string"
          },
          "autodiscover_url": {
            "description": "Outlook-style autodiscover.",
            "type": "string"
          },
          "incoming": {
            "$ref": "#/components/schemas/MailClientEndpoint"
          },
          "outgoing": {
            "items": {
              "$ref": "#/components/schemas/MailClientEndpoint"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "username": {
            "description": "The full address.",
            "type": "string"
          },
          "webmail_url": {
            "type": "string"
          }
        },
        "required": [
          "address",
          "username",
          "incoming",
          "outgoing",
          "webmail_url",
          "autoconfig_url",
          "autodiscover_url"
        ],
        "type": "object"
      },
      "MailCountersView": {
        "additionalProperties": false,
        "properties": {
          "bounced": {
            "format": "int64",
            "type": "integer"
          },
          "deferred": {
            "format": "int64",
            "type": "integer"
          },
          "delivered": {
            "format": "int64",
            "type": "integer"
          },
          "delivered_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "junk": {
            "format": "int64",
            "type": "integer"
          },
          "logins_failed": {
            "format": "int64",
            "type": "integer"
          },
          "logins_ok": {
            "format": "int64",
            "type": "integer"
          },
          "rejected": {
            "format": "int64",
            "type": "integer"
          },
          "send_limited": {
            "format": "int64",
            "type": "integer"
          },
          "sent": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "delivered",
          "rejected",
          "junk",
          "sent",
          "deferred",
          "bounced",
          "logins_ok",
          "logins_failed",
          "send_limited",
          "delivered_bytes"
        ],
        "type": "object"
      },
      "MailDKIMView": {
        "additionalProperties": false,
        "properties": {
          "active_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "published": {
            "description": "The agent returned its public key.",
            "type": "boolean"
          },
          "selector": {
            "type": "string"
          },
          "sign": {
            "type": "boolean"
          },
          "state": {
            "enum": [
              "pending",
              "active",
              "retiring",
              "retired"
            ],
            "type": "string"
          }
        },
        "required": [
          "selector",
          "state",
          "sign",
          "published",
          "created_at"
        ],
        "type": "object"
      },
      "MailDNSRecordView": {
        "additionalProperties": false,
        "properties": {
          "checked_at": {
            "format": "date-time",
            "type": "string"
          },
          "found": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "ok": {
            "description": "The last check found it (absent: not checked yet).",
            "type": "boolean"
          },
          "purpose": {
            "enum": [
              "mx",
              "address",
              "spf",
              "dkim",
              "dmarc",
              "mta-sts",
              "tls-rpt",
              "srv"
            ],
            "type": "string"
          },
          "ttl": {
            "format": "int32",
            "type": "integer"
          },
          "type": {
            "type": "string"
          },
          "value": {
            "description": "TXT: the text to publish (one string; long values may be split into 255-byte strings).",
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "ttl",
          "value",
          "purpose"
        ],
        "type": "object"
      },
      "MailDNSView": {
        "additionalProperties": false,
        "properties": {
          "checked_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "domain_id": {
            "type": "string"
          },
          "mode": {
            "enum": [
              "managed",
              "external"
            ],
            "type": "string"
          },
          "records": {
            "items": {
              "$ref": "#/components/schemas/MailDNSRecordView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "status": {
            "enum": [
              "",
              "ok",
              "pending",
              "conflict"
            ],
            "type": "string"
          },
          "verification": {
            "$ref": "#/components/schemas/MailVerificationView"
          },
          "zone": {
            "type": "string"
          }
        },
        "required": [
          "domain_id",
          "mode",
          "status",
          "records"
        ],
        "type": "object"
      },
      "MailDomainActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "domain": {
            "$ref": "#/components/schemas/MailDomainView"
          },
          "job_id": {
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "type": "object"
      },
      "MailDomainListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/MailDomainView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "MailDomainView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "cert_not_after": {
            "format": "date-time",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "dkim": {
            "items": {
              "$ref": "#/components/schemas/MailDKIMView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "dmarc_policy": {
            "enum": [
              "none",
              "quarantine",
              "reject"
            ],
            "type": "string"
          },
          "dns_checked_at": {
            "format": "date-time",
            "type": "string"
          },
          "dns_detail": {
            "type": "string"
          },
          "dns_mode": {
            "enum": [
              "managed",
              "external"
            ],
            "type": "string"
          },
          "dns_status": {
            "description": "Last check: empty = never checked.",
            "enum": [
              "",
              "ok",
              "pending",
              "conflict"
            ],
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "mta_sts_mode": {
            "enum": [
              "none",
              "testing",
              "enforce"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "server_id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "pending_verification",
              "pending",
              "active",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "tls_ready": {
            "description": "A certificate for mail.\u003cdomain\u003e is served.",
            "type": "boolean"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "verification": {
            "$ref": "#/components/schemas/MailVerificationView"
          },
          "webmail_url": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "server_id",
          "name",
          "enabled",
          "state",
          "dns_mode",
          "dns_status",
          "dmarc_policy",
          "mta_sts_mode",
          "tls_ready",
          "dkim",
          "webmail_url",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "MailForwardView": {
        "additionalProperties": false,
        "properties": {
          "addresses": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "keep_copy": {
            "type": "boolean"
          }
        },
        "required": [
          "addresses",
          "keep_copy"
        ],
        "type": "object"
      },
      "MailQueueInputBody": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "list",
              "retry",
              "fail",
              "hold",
              "release"
            ],
            "type": "string"
          },
          "ids": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "maxItems": 200,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "action"
        ],
        "type": "object"
      },
      "MailServerActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "acme_production": {
            "type": "boolean"
          },
          "domains": {
            "format": "int64",
            "type": "integer"
          },
          "enabled": {
            "description": "What the admin asked for (default false).",
            "type": "boolean"
          },
          "hostname": {
            "description": "The server's mail host name (EHLO, default certificate).",
            "type": "string"
          },
          "job_id": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "outgoing": {
            "enum": [
              "platform",
              "custom",
              "direct",
              "none"
            ],
            "type": "string"
          },
          "ports": {
            "description": "Ports opened while a domain has mail: 25, 465, 587, 993.",
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "relay_configured": {
            "description": "The platform relay is configured (outgoing platform is available).",
            "type": "boolean"
          },
          "server_id": {
            "type": "string"
          },
          "smarthost": {
            "$ref": "#/components/schemas/MailSmarthostView"
          },
          "status": {
            "$ref": "#/components/schemas/MailStatusView"
          },
          "supported": {
            "description": "The agent reports a mail engine (M15).",
            "type": "boolean"
          }
        },
        "required": [
          "job_id",
          "server_id",
          "supported",
          "enabled",
          "hostname",
          "outgoing",
          "acme_production",
          "relay_configured",
          "domains",
          "ports"
        ],
        "type": "object"
      },
      "MailServerView": {
        "additionalProperties": false,
        "properties": {
          "acme_production": {
            "type": "boolean"
          },
          "domains": {
            "format": "int64",
            "type": "integer"
          },
          "enabled": {
            "description": "What the admin asked for (default false).",
            "type": "boolean"
          },
          "hostname": {
            "description": "The server's mail host name (EHLO, default certificate).",
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "outgoing": {
            "enum": [
              "platform",
              "custom",
              "direct",
              "none"
            ],
            "type": "string"
          },
          "ports": {
            "description": "Ports opened while a domain has mail: 25, 465, 587, 993.",
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "relay_configured": {
            "description": "The platform relay is configured (outgoing platform is available).",
            "type": "boolean"
          },
          "server_id": {
            "type": "string"
          },
          "smarthost": {
            "$ref": "#/components/schemas/MailSmarthostView"
          },
          "status": {
            "$ref": "#/components/schemas/MailStatusView"
          },
          "supported": {
            "description": "The agent reports a mail engine (M15).",
            "type": "boolean"
          }
        },
        "required": [
          "server_id",
          "supported",
          "enabled",
          "hostname",
          "outgoing",
          "acme_production",
          "relay_configured",
          "domains",
          "ports"
        ],
        "type": "object"
      },
      "MailSmarthostView": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "type": "string"
          },
          "password_set": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "spf_include": {
            "type": "string"
          },
          "tls": {
            "enum": [
              "submissions",
              "starttls"
            ],
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "host",
          "port",
          "tls",
          "username",
          "password_set"
        ],
        "type": "object"
      },
      "MailStatusView": {
        "additionalProperties": false,
        "properties": {
          "counters": {
            "$ref": "#/components/schemas/MailCountersView"
          },
          "detail": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "hostname": {
            "type": "string"
          },
          "image_digest": {
            "type": "string"
          },
          "outgoing": {
            "description": "smarthost, direct or none",
            "type": "string"
          },
          "queue_held": {
            "format": "int32",
            "type": "integer"
          },
          "queue_oldest_seconds": {
            "format": "int32",
            "type": "integer"
          },
          "queue_size": {
            "format": "int32",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "running": {
            "type": "boolean"
          },
          "started_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "running",
          "queue_size",
          "queue_held",
          "queue_oldest_seconds",
          "counters",
          "reported_at"
        ],
        "type": "object"
      },
      "MailVerificationView": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "_pluspanel-verify.\u003cdomain\u003e",
            "type": "string"
          },
          "type": {
            "enum": [
              "TXT"
            ],
            "type": "string"
          },
          "value": {
            "description": "pp-verify=\u003c32 hex\u003e",
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "value"
        ],
        "type": "object"
      },
      "MailboxActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "type": "string"
          },
          "mailbox": {
            "$ref": "#/components/schemas/MailboxView"
          }
        },
        "required": [
          "mailbox",
          "job_id"
        ],
        "type": "object"
      },
      "MailboxAutoresponderInputBody": {
        "additionalProperties": false,
        "properties": {
          "body": {
            "maxLength": 8192,
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "ends_at": {
            "format": "date-time",
            "type": "string"
          },
          "interval_hours": {
            "description": "At most one reply per sender per this many hours (0: 96).",
            "format": "int32",
            "maximum": 8760,
            "minimum": 0,
            "type": "integer"
          },
          "starts_at": {
            "format": "date-time",
            "type": "string"
          },
          "subject": {
            "maxLength": 200,
            "type": "string"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "MailboxForwardInputBody": {
        "additionalProperties": false,
        "properties": {
          "addresses": {
            "description": "External addresses; empty: no forwarding.",
            "items": {
              "type": "string"
            },
            "maxItems": 10,
            "type": [
              "array",
              "null"
            ]
          },
          "keep_copy": {
            "type": "boolean"
          }
        },
        "required": [
          "addresses"
        ],
        "type": "object"
      },
      "MailboxImportInputBody": {
        "additionalProperties": false,
        "properties": {
          "format": {
            "enum": [
              "maildir",
              "mbox",
              ""
            ],
            "type": "string"
          },
          "imap": {
            "$ref": "#/components/schemas/IMAPStruct"
          },
          "path": {
            "description": "files: a virtual path of the account (/web/\u003csite-key\u003e/...).",
            "maxLength": 4096,
            "type": "string"
          },
          "source": {
            "enum": [
              "files",
              "imap"
            ],
            "type": "string"
          },
          "target_folder": {
            "maxLength": 200,
            "type": "string"
          }
        },
        "required": [
          "source"
        ],
        "type": "object"
      },
      "MailboxListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/MailboxView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "MailboxPasswordInputBody": {
        "additionalProperties": false,
        "properties": {
          "generate": {
            "description": "Generate one; it is shown once through GET /jobs/{job_id}/sensitive.",
            "type": "boolean"
          },
          "password": {
            "description": "A chosen password (policy-checked, sealed to the server's key).",
            "maxLength": 128,
            "type": "string"
          }
        },
        "type": "object"
      },
      "MailboxView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "account_name": {
            "type": "string"
          },
          "address": {
            "type": "string"
          },
          "autoresponder": {
            "$ref": "#/components/schemas/MailAutoresponderView"
          },
          "autoresponder_active": {
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "display_name": {
            "type": "string"
          },
          "domain_id": {
            "type": "string"
          },
          "forward": {
            "$ref": "#/components/schemas/MailForwardView"
          },
          "forwarding_active": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "local_part": {
            "type": "string"
          },
          "login_enabled": {
            "type": "boolean"
          },
          "quota_bytes": {
            "description": "0 = unlimited; mail is accepted up to 110 %.",
            "format": "int64",
            "type": "integer"
          },
          "quota_state": {
            "enum": [
              "",
              "ok",
              "warn",
              "over",
              "full"
            ],
            "type": "string"
          },
          "send_limit_per_hour": {
            "format": "int32",
            "type": "integer"
          },
          "sent_last_hour": {
            "format": "int32",
            "type": "integer"
          },
          "state": {
            "enum": [
              "pending",
              "active",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "usage_at": {
            "format": "date-time",
            "type": "string"
          },
          "usage_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "webmail_url": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "domain_id",
          "account_id",
          "address",
          "local_part",
          "display_name",
          "quota_bytes",
          "send_limit_per_hour",
          "login_enabled",
          "state",
          "usage_bytes",
          "quota_state",
          "sent_last_hour",
          "forwarding_active",
          "autoresponder_active",
          "webmail_url",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "MeAPIKey": {
        "additionalProperties": false,
        "properties": {
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "personal",
              "organization"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "public_id": {
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "public_id",
          "name",
          "kind",
          "scopes",
          "expires_at"
        ],
        "type": "object"
      },
      "MeBody": {
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "$ref": "#/components/schemas/MeAPIKey",
            "description": "Present when the request was made with an API key: the key the caller authenticated with."
          },
          "impersonation": {
            "$ref": "#/components/schemas/ImpersonationView",
            "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
          },
          "mfa_pending": {
            "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
            "type": "boolean"
          },
          "permissions": {
            "description": "Every permission the user holds, at any scope, sorted.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "roles": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "scopes": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
            "type": "object"
          },
          "tenant": {
            "$ref": "#/components/schemas/TenantView"
          },
          "user": {
            "$ref": "#/components/schemas/UserView"
          }
        },
        "required": [
          "user",
          "tenant",
          "roles",
          "permissions",
          "scopes",
          "mfa_pending"
        ],
        "type": "object"
      },
      "NameserverListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/NameserverView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "NameserverSyncView": {
        "additionalProperties": false,
        "properties": {
          "applied_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "applied_serial": {
            "description": "Serial the nameserver serves (0: not yet).",
            "format": "int64",
            "type": "integer"
          },
          "error": {
            "description": "Last sync failure; empty when the last attempt succeeded.",
            "type": "string"
          },
          "in_sync": {
            "description": "The nameserver serves the current serial and reported no error.",
            "type": "boolean"
          },
          "name": {
            "examples": [
              "ns1"
            ],
            "type": "string"
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "signed": {
            "description": "The nameserver signs the zone with the shared key.",
            "type": "boolean"
          },
          "verified_at": {
            "description": "Last full content comparison.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "applied_serial",
          "in_sync",
          "signed",
          "applied_at",
          "verified_at",
          "error",
          "next_attempt_at"
        ],
        "type": "object"
      },
      "NameserverView": {
        "additionalProperties": false,
        "properties": {
          "checked_at": {
            "description": "Null until the sync engine reached it once.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "healthy": {
            "type": "boolean"
          },
          "last_error": {
            "type": "string"
          },
          "last_ok_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "examples": [
              "ns1"
            ],
            "type": "string"
          },
          "version": {
            "examples": [
              "5.1.4"
            ],
            "type": "string"
          },
          "zones": {
            "description": "Zones it served after the last pass.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "name",
          "healthy",
          "version",
          "zones",
          "last_ok_at",
          "last_error",
          "checked_at"
        ],
        "type": "object"
      },
      "NewRecoveryCodesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "codes": {
            "description": "10 single-use codes, shown once; the previous set no longer works.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "codes"
        ],
        "type": "object"
      },
      "OSRollback": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "from_digest": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "to_digest": {
            "type": "string"
          }
        },
        "required": [
          "reason",
          "from_digest",
          "to_digest"
        ],
        "type": "object"
      },
      "OSStatus": {
        "additionalProperties": false,
        "properties": {
          "booted_digest": {
            "type": "string"
          },
          "deployments": {
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "last_cleanup_at": {
            "format": "date-time",
            "type": "string"
          },
          "last_rollback": {
            "$ref": "#/components/schemas/OSRollback"
          },
          "rollback_digest": {
            "type": "string"
          },
          "staged_digest": {
            "type": "string"
          }
        },
        "required": [
          "booted_digest",
          "staged_digest",
          "rollback_digest",
          "deployments"
        ],
        "type": "object"
      },
      "OSUpdateView": {
        "additionalProperties": false,
        "properties": {
          "confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "detail": {
            "type": [
              "string",
              "null"
            ]
          },
          "expected_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "image_ref": {
            "type": [
              "string",
              "null"
            ]
          },
          "kind": {
            "enum": [
              "apply",
              "rollback"
            ],
            "type": "string"
          },
          "observed_os_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "previous_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "staged_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "staged_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "awaiting_reboot",
              "confirmed",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "kind",
          "status",
          "image_ref",
          "expected_digest",
          "previous_digest",
          "staged_digest",
          "detail",
          "observed_os_version",
          "staged_at",
          "confirmed_at"
        ],
        "type": "object"
      },
      "ObservabilitySettingsView": {
        "additionalProperties": false,
        "properties": {
          "central_available": {
            "description": "This platform has central stores.",
            "type": "boolean"
          },
          "central_enabled": {
            "description": "Raw metrics and logs are uploaded to the central stores (consent).",
            "type": "boolean"
          },
          "consent_version": {
            "description": "The acknowledged consent text (current: obs-central-v1).",
            "type": "string"
          },
          "consented_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "consented_by_user_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "current_consent_version": {
            "type": "string"
          },
          "raw_purge_pending": {
            "description": "A revocation's deletion of the raw central data is still being retried.",
            "type": "boolean"
          },
          "revoked_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "revoked_by_user_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "servers": {
            "items": {
              "$ref": "#/components/schemas/ServerTelemetrySettings"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "central_available",
          "central_enabled",
          "consent_version",
          "current_consent_version",
          "consented_by_user_id",
          "consented_at",
          "revoked_by_user_id",
          "revoked_at",
          "raw_purge_pending",
          "servers"
        ],
        "type": "object"
      },
      "OneTimeLink": {
        "additionalProperties": false,
        "properties": {
          "emailed": {
            "description": "True when the link was also emailed (SMTP configured and send_email set).",
            "type": "boolean"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "path": {
            "description": "Panel path to open (the token is in the fragment, never sent to a server).",
            "examples": [
              "/invite#ppi1.…"
            ],
            "type": "string"
          },
          "token": {
            "description": "Shown once; stored only as an argon2id hash. Single use, 48 hours.",
            "type": "string"
          }
        },
        "required": [
          "token",
          "path",
          "expires_at",
          "emailed"
        ],
        "type": "object"
      },
      "OpenTerminalInputBody": {
        "additionalProperties": false,
        "properties": {
          "cols": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "container": {
            "pattern": "^pp-[a-z0-9][a-z0-9-]{0,59}$",
            "type": "string"
          },
          "rows": {
            "format": "int32",
            "maximum": 500,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "container"
        ],
        "type": "object"
      },
      "OrganizationChoice": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "slug",
          "name"
        ],
        "type": "object"
      },
      "OverridesBody": {
        "additionalProperties": false,
        "properties": {
          "cpu_millicores": {
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "inode_limit": {
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "mail_send_limit_per_hour": {
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "mailbox_quota_bytes": {
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "max_db_services": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sftp_users": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "memory_bytes": {
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "php_versions_allowed": {
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": "array"
          },
          "quota_bytes": {
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          },
          "sftp_allowed": {
            "type": "boolean"
          },
          "terminal_enabled": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "PHPVersionListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PHPVersionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PHPVersionView": {
        "additionalProperties": false,
        "properties": {
          "is_default": {
            "description": "The version new sites get.",
            "type": "boolean"
          },
          "status": {
            "description": "eol: still selectable, upstream security support ended; disabled: not selectable (sites already on it keep it).",
            "enum": [
              "supported",
              "eol",
              "disabled"
            ],
            "type": "string"
          },
          "version": {
            "examples": [
              "8.4"
            ],
            "type": "string"
          }
        },
        "required": [
          "version",
          "status",
          "is_default"
        ],
        "type": "object"
      },
      "PMASessionInputBody": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "type": "string"
          },
          "host_site_id": {
            "description": "The site whose HTTPS name carries the link; empty: any site of the account that serves HTTPS.",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "database"
        ],
        "type": "object"
      },
      "PMASessionView": {
        "additionalProperties": false,
        "properties": {
          "closed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "consumed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "database": {
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "host": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "job_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "minted_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "minted",
              "consumed",
              "expired",
              "closed"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "database",
          "host",
          "state",
          "job_id",
          "minted_at",
          "expires_at",
          "consumed_at",
          "closed_at"
        ],
        "type": "object"
      },
      "PageAPIKeyView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/APIKeyView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageAccountSummaryView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AccountSummaryView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageAccountView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AccountView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageAuditView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AuditView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageExitReportView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ExitReportView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageJobView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/JobView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageRolloutView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RolloutView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageServerView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ServerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageUserView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/UserView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageWAFEventView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WAFEventView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageWaitlistEntryView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WaitlistEntryView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageWebhookDeliveryView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WebhookDeliveryView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PageWebhookView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WebhookView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_cursor": {
            "description": "Cursor for the next page; null on the last page.",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "next_cursor"
        ],
        "type": "object"
      },
      "PanelDNSView": {
        "additionalProperties": false,
        "properties": {
          "addresses": {
            "description": "What the host resolves to now.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "panel_targets": {
            "description": "The panel's addresses: point A/AAAA records here.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "points_to_panel": {
            "description": "At least one address is the panel's and none is foreign.",
            "type": "boolean"
          },
          "records": {
            "description": "The records to create (or created with manage_dns).",
            "items": {
              "$ref": "#/components/schemas/RecordHint"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "zone_id": {
            "description": "When the host lies in a DNS zone of this organization (M12), its id.",
            "type": "string"
          },
          "zone_name": {
            "type": "string"
          }
        },
        "required": [
          "addresses",
          "points_to_panel",
          "panel_targets",
          "records"
        ],
        "type": "object"
      },
      "PanelHostAllowedOutputBody": {
        "additionalProperties": false,
        "properties": {
          "allowed": {
            "type": "boolean"
          }
        },
        "required": [
          "allowed"
        ],
        "type": "object"
      },
      "PanelHostView": {
        "additionalProperties": false,
        "properties": {
          "dns": {
            "$ref": "#/components/schemas/PanelDNSView"
          },
          "panel_host": {
            "type": [
              "string",
              "null"
            ]
          },
          "tls": {
            "$ref": "#/components/schemas/PanelTLSView"
          }
        },
        "required": [
          "panel_host"
        ],
        "type": "object"
      },
      "PanelSeriesView": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "labels": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "points": {
            "description": "[Unix seconds, value] pairs, oldest first.",
            "items": {
              "items": {
                "format": "double",
                "type": "number"
              },
              "maxItems": 2,
              "minItems": 2,
              "type": [
                "array",
                "null"
              ]
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "labels",
          "points"
        ],
        "type": "object"
      },
      "PanelTLSView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "not_after": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "description": "active: a certificate for the host is served; pending: none yet (the edge obtains it on the first HTTPS request once DNS points here); error: see detail.",
            "enum": [
              "active",
              "pending",
              "error"
            ],
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "PanelView": {
        "additionalProperties": false,
        "properties": {
          "panel": {
            "type": "string"
          },
          "series": {
            "items": {
              "$ref": "#/components/schemas/PanelSeriesView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "source": {
            "description": "central: the platform's stores; local: read from the server through a signed query.",
            "enum": [
              "central",
              "local"
            ],
            "type": "string"
          },
          "step": {
            "description": "Seconds between points.",
            "format": "int64",
            "type": "integer"
          },
          "unit": {
            "description": "ratio, bytes, bytes_per_second, load, cores, requests, containers or inodes. Central and local answers of a panel may differ in unit (the aggregates carry ratios where the local store has counts).",
            "type": "string"
          }
        },
        "required": [
          "panel",
          "unit",
          "step",
          "series",
          "source"
        ],
        "type": "object"
      },
      "Param": {
        "additionalProperties": false,
        "properties": {
          "default": {
            "format": "double",
            "type": "number"
          },
          "doc": {
            "type": "string"
          },
          "max": {
            "format": "double",
            "type": "number"
          },
          "min": {
            "format": "double",
            "type": "number"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "default",
          "min",
          "max",
          "doc"
        ],
        "type": "object"
      },
      "PasskeyRegisterBeginOutputBody": {
        "additionalProperties": false,
        "properties": {
          "challenge_id": {
            "format": "uuid",
            "type": "string"
          },
          "publicKey": {
            "description": "PublicKeyCredentialCreationOptions as JSON; binary fields are base64url."
          }
        },
        "required": [
          "challenge_id",
          "publicKey"
        ],
        "type": "object"
      },
      "PasskeyRegisterFinishInputBody": {
        "additionalProperties": false,
        "properties": {
          "challenge_id": {
            "format": "uuid",
            "type": "string"
          },
          "credential": {},
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "challenge_id",
          "name",
          "credential"
        ],
        "type": "object"
      },
      "PasskeyRegisterFinishOutputBody": {
        "additionalProperties": false,
        "properties": {
          "passkey": {
            "$ref": "#/components/schemas/PasskeyView"
          },
          "recovery_codes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "passkey"
        ],
        "type": "object"
      },
      "PasskeyView": {
        "additionalProperties": false,
        "properties": {
          "backup_eligible": {
            "description": "A synced passkey (it can be backed up).",
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_used_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "rp_id": {
            "description": "The address (RP ID) the passkey works on.",
            "type": "string"
          },
          "usable_here": {
            "description": "The passkey works on the address of this request.",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "name",
          "rp_id",
          "created_at",
          "last_used_at",
          "backup_eligible",
          "usable_here"
        ],
        "type": "object"
      },
      "PasskeysOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PasskeyView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PasswordResetInputBody": {
        "additionalProperties": false,
        "properties": {
          "send_email": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "PatchChannelInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig",
            "description": "Replaces the configuration."
          },
          "enabled": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "secret": {
            "$ref": "#/components/schemas/ChannelSecret",
            "description": "Replaces the secret (write-only)."
          }
        },
        "type": "object"
      },
      "PatchIncidentInputBody": {
        "additionalProperties": false,
        "properties": {
          "body": {
            "description": "A public note (required when the state changes).",
            "maxLength": 2000,
            "type": "string"
          },
          "impact": {
            "enum": [
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "state": {
            "enum": [
              "investigating",
              "identified",
              "monitoring",
              "resolved"
            ],
            "type": "string"
          },
          "title": {
            "maxLength": 200,
            "minLength": 1,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchWebhookInputBody": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "maxLength": 200,
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "events": {
            "description": "Replaces the patterns.",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "url": {
            "maxLength": 2048,
            "minLength": 9,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PendingAccount": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "reason": {
            "type": "string"
          }
        },
        "required": [
          "account_id",
          "reason"
        ],
        "type": "object"
      },
      "PlanFields": {
        "additionalProperties": false,
        "properties": {
          "cpu_millicores": {
            "description": "CPU envelope in millicores (1000 = one CPU).",
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "inode_limit": {
            "description": "Inode limit: 1000 to 100M.",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "mail_send_limit_per_hour": {
            "description": "Default outgoing messages per hour of a new mailbox (default 200).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "mailbox_quota_bytes": {
            "description": "Default quota of a new mailbox in bytes (0 = unlimited; default 1 GiB).",
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "max_db_services": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sftp_users": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "memory_bytes": {
            "description": "Memory envelope: 64 MiB to 256 GiB.",
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "php_versions_allowed": {
            "description": "Allowed PHP versions (X.Y); empty = every supported version.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "quota_bytes": {
            "description": "Disk quota: 64 MiB to 16 TiB.",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          },
          "sftp_allowed": {
            "type": "boolean"
          },
          "terminal_enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "quota_bytes",
          "inode_limit",
          "cpu_millicores",
          "memory_bytes",
          "max_sites",
          "max_db_services",
          "max_sftp_users",
          "terminal_enabled",
          "sftp_allowed",
          "php_versions_allowed"
        ],
        "type": "object"
      },
      "PlanInputBody": {
        "additionalProperties": false,
        "properties": {
          "cpu_millicores": {
            "description": "CPU envelope in millicores (1000 = one CPU).",
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "inode_limit": {
            "description": "Inode limit: 1000 to 100M.",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "mail_send_limit_per_hour": {
            "description": "Default outgoing messages per hour of a new mailbox (default 200).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "mailbox_quota_bytes": {
            "description": "Default quota of a new mailbox in bytes (0 = unlimited; default 1 GiB).",
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "max_db_services": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sftp_users": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "memory_bytes": {
            "description": "Memory envelope: 64 MiB to 256 GiB.",
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "php_versions_allowed": {
            "description": "Allowed PHP versions (X.Y); empty = every supported version.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "quota_bytes": {
            "description": "Disk quota: 64 MiB to 16 TiB.",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          },
          "sftp_allowed": {
            "type": "boolean"
          },
          "terminal_enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "quota_bytes",
          "inode_limit",
          "cpu_millicores",
          "memory_bytes",
          "max_sites",
          "max_db_services",
          "max_sftp_users",
          "terminal_enabled",
          "sftp_allowed",
          "php_versions_allowed"
        ],
        "type": "object"
      },
      "PlanListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PlanView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PlanUpdateOutputBody": {
        "additionalProperties": false,
        "properties": {
          "converged": {
            "description": "Accounts whose new limits were enqueued (update_account_quota / ensure_account_runtime).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "pending": {
            "items": {
              "$ref": "#/components/schemas/PendingAccount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "plan": {
            "$ref": "#/components/schemas/PlanView"
          }
        },
        "required": [
          "plan",
          "converged",
          "pending"
        ],
        "type": "object"
      },
      "PlanView": {
        "additionalProperties": false,
        "properties": {
          "account_count": {
            "description": "Accounts (not purged) on the plan.",
            "format": "int64",
            "type": "integer"
          },
          "archived_at": {
            "description": "Archived plans keep their accounts but take no new ones.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "cpu_millicores": {
            "description": "CPU envelope in millicores (1000 = one CPU).",
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "inode_limit": {
            "description": "Inode limit: 1000 to 100M.",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "is_default": {
            "description": "Accounts created without a plan get this one.",
            "type": "boolean"
          },
          "mail_send_limit_per_hour": {
            "description": "Default outgoing messages per hour of a new mailbox (default 200).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "mailbox_quota_bytes": {
            "description": "Default quota of a new mailbox in bytes (0 = unlimited; default 1 GiB).",
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "max_db_services": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sftp_users": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "memory_bytes": {
            "description": "Memory envelope: 64 MiB to 256 GiB.",
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "php_versions_allowed": {
            "description": "Allowed PHP versions (X.Y); empty = every supported version.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "quota_bytes": {
            "description": "Disk quota: 64 MiB to 16 TiB.",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          },
          "sftp_allowed": {
            "type": "boolean"
          },
          "terminal_enabled": {
            "type": "boolean"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "is_default",
          "archived_at",
          "account_count",
          "created_at",
          "updated_at",
          "quota_bytes",
          "inode_limit",
          "cpu_millicores",
          "memory_bytes",
          "max_sites",
          "max_db_services",
          "max_sftp_users",
          "terminal_enabled",
          "sftp_allowed",
          "php_versions_allowed"
        ],
        "type": "object"
      },
      "PluginSetItemView": {
        "additionalProperties": false,
        "properties": {
          "slug": {
            "type": "string"
          },
          "version": {
            "description": "Empty: the current release.",
            "type": "string"
          }
        },
        "required": [
          "slug",
          "version"
        ],
        "type": "object"
      },
      "PluginSetListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PluginSetView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PluginSetView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "is_default": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "plugins": {
            "items": {
              "$ref": "#/components/schemas/PluginSetItemView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "name",
          "is_default",
          "plugins",
          "created_at"
        ],
        "type": "object"
      },
      "Problem": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "Stable machine-readable error code: clients branch on it, never on messages.",
            "examples": [
              "not_found"
            ],
            "type": "string"
          },
          "detail": {
            "description": "Human-readable description (English).",
            "type": "string"
          },
          "error": {
            "$ref": "#/components/schemas/ErrorBody",
            "description": "Legacy ADR-0002 envelope with the same code, message and request id. Deprecated: read the problem members instead."
          },
          "instance": {
            "description": "The request path.",
            "examples": [
              "/api/v1/servers/0b6f7c3e-5d1a-4f7e-9c2b-1f4a8e6d3c21"
            ],
            "type": "string"
          },
          "request_id": {
            "description": "Correlates with server logs (the X-Request-ID header).",
            "type": "string"
          },
          "status": {
            "description": "The HTTP status code.",
            "examples": [
              404
            ],
            "format": "int64",
            "maximum": 599,
            "minimum": 400,
            "type": "integer"
          },
          "title": {
            "description": "The HTTP status text.",
            "examples": [
              "Not Found"
            ],
            "type": "string"
          },
          "type": {
            "description": "https://pluspanel.net/problems/\u003ccode\u003e.",
            "examples": [
              "https://pluspanel.net/problems/not_found"
            ],
            "format": "uri",
            "type": "string"
          }
        },
        "required": [
          "type",
          "title",
          "status",
          "detail",
          "instance",
          "code",
          "request_id",
          "error"
        ],
        "type": "object"
      },
      "PutAlertRuleInputBody": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "params": {
            "additionalProperties": {
              "format": "double",
              "type": "number"
            },
            "description": "Only the parameters to change from the defaults; omitted = defaults.",
            "type": "object"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "PutObservabilitySettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "central_enabled": {
            "description": "Opt in (true) or revoke (false). Opting in needs consent_version.",
            "type": "boolean"
          },
          "consent_version": {
            "description": "The consent text the user acknowledged: obs-central-v1.",
            "type": "string"
          },
          "servers": {
            "items": {
              "$ref": "#/components/schemas/ServerTelemetrySettingsInput"
            },
            "maxItems": 500,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "Quota": {
        "additionalProperties": false,
        "properties": {
          "addon_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "included_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "quota_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "test_cap_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "tier": {
            "type": "string"
          },
          "used_bytes": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "tier",
          "quota_bytes",
          "used_bytes",
          "included_bytes",
          "addon_bytes"
        ],
        "type": "object"
      },
      "RecordBody": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "description": "A/AAAA: address; CNAME/NS: target; MX: \"\u003cpreference\u003e \u003chost\u003e\"; SRV: \"\u003cpriority\u003e \u003cweight\u003e \u003cport\u003e \u003ctarget\u003e\"; CAA: \"\u003cflags\u003e \u003ctag\u003e \u003cvalue\u003e\"; DS (only next to the NS of a delegation): \"\u003ckey tag\u003e \u003calgorithm\u003e \u003cdigest type\u003e \u003cdigest\u003e\"; TXT: text (printable ASCII without \" and \\; split into 255-byte strings).",
            "examples": [
              "192.0.2.1"
            ],
            "type": "string"
          },
          "name": {
            "description": "Relative (www), absolute (www.example.com, with or without a trailing dot) or @ for the apex. A leading * label is a wildcard.",
            "examples": [
              "www"
            ],
            "type": "string"
          },
          "ttl": {
            "description": "60 to 86400; default 3600. Records of one name and type share it (the last write wins for the whole set).",
            "format": "int32",
            "type": "integer"
          },
          "type": {
            "enum": [
              "A",
              "AAAA",
              "CNAME",
              "MX",
              "TXT",
              "SRV",
              "CAA",
              "NS",
              "DS"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "content"
        ],
        "type": "object"
      },
      "RecordHint": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "present": {
            "description": "Already in the hosted zone.",
            "type": "boolean"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "content",
          "present"
        ],
        "type": "object"
      },
      "RecordListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RecordView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "RecordView": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "description": "Canonical presentation form (targets end with a dot, TXT is quoted).",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "managed_by": {
            "description": "template: created with the zone; site: the site record template; acme: a DNS-01 challenge value (read-only); caa: the platform's Let's Encrypt CAA records at the host names of sites with automatic TLS (read-only; an own CAA record at the name or above it replaces them); mail: the records of a mail domain (M15, read-only; change the mail domain instead).",
            "enum": [
              "user",
              "template",
              "site",
              "acme",
              "caa",
              "mail"
            ],
            "type": "string"
          },
          "name": {
            "description": "Owner, absolute (no trailing dot).",
            "examples": [
              "www.example.com"
            ],
            "type": "string"
          },
          "relative_name": {
            "description": "Owner relative to the zone (@ for the apex).",
            "examples": [
              "www"
            ],
            "type": "string"
          },
          "site_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "ttl": {
            "format": "int32",
            "type": "integer"
          },
          "type": {
            "enum": [
              "A",
              "AAAA",
              "CNAME",
              "MX",
              "TXT",
              "SRV",
              "CAA",
              "NS",
              "DS"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "relative_name",
          "type",
          "ttl",
          "content",
          "managed_by",
          "site_id",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "RecoveryCodesBody": {
        "additionalProperties": false,
        "properties": {
          "recovery_codes": {
            "description": "Present when this was the first factor: 10 single-use codes, shown once.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "RegisterReleaseInputBody": {
        "additionalProperties": false,
        "properties": {
          "component": {
            "enum": [
              "pluspanel-os",
              "pluspanel-agent"
            ],
            "type": "string"
          },
          "digest": {
            "description": "Optional with a registry (must match the version tag); required without one (dev, E2E).",
            "maxLength": 71,
            "type": "string"
          },
          "version": {
            "description": "The released version (its registry tag), e.g. 10.11.0 or 1.1.0.",
            "maxLength": 64,
            "type": "string"
          }
        },
        "required": [
          "component",
          "version"
        ],
        "type": "object"
      },
      "ReleaseView": {
        "additionalProperties": false,
        "properties": {
          "completed_on": {
            "description": "Channels on which a rollout of this release completed (stable needs preview first).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "component": {
            "enum": [
              "pluspanel-os",
              "pluspanel-agent"
            ],
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "digest": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "description": "security makes its rollouts express (shorter observation, never fewer gates).",
            "enum": [
              "routine",
              "security"
            ],
            "type": "string"
          },
          "seen_preview_at": {
            "description": "When the registry's :preview first named it.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "seen_stable_at": {
            "description": "When the registry's :stable first named it.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "source": {
            "enum": [
              "watcher",
              "operator"
            ],
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "component",
          "version",
          "digest",
          "kind",
          "source",
          "seen_preview_at",
          "seen_stable_at",
          "completed_on",
          "created_at"
        ],
        "type": "object"
      },
      "ReleasesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ReleaseView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ReloadIngressInputBody": {
        "additionalProperties": false,
        "properties": {
          "restart": {
            "description": "Restart the ingress container before reloading (drills: the routes must come back by themselves).",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "ReloadIngressOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "description": "Poll GET /jobs/{id}.",
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "job_id"
        ],
        "type": "object"
      },
      "RemovalTokenOutputBody": {
        "additionalProperties": false,
        "properties": {
          "confirm_token": {
            "description": "Present it to DELETE /sites/{id}. Not a secret: it binds the intent to this site on this server.",
            "examples": [
              "rw1-0123456789abcdef0123456789abcdef"
            ],
            "type": "string"
          }
        },
        "required": [
          "confirm_token"
        ],
        "type": "object"
      },
      "RenamePasskeyInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "RenewSiteCertificateInputBody": {
        "additionalProperties": false,
        "properties": {
          "force": {
            "description": "Renew even if the certificate is not due.",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "ReplaceRecordsInputBody": {
        "additionalProperties": false,
        "properties": {
          "records": {
            "items": {
              "$ref": "#/components/schemas/RecordBody"
            },
            "maxItems": 5000,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "records"
        ],
        "type": "object"
      },
      "ResellerLimits": {
        "additionalProperties": false,
        "properties": {
          "max_accounts": {
            "format": "int32",
            "type": "integer"
          },
          "max_disk_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "max_accounts",
          "max_disk_bytes",
          "max_sites"
        ],
        "type": "object"
      },
      "ResellerLimitsValues": {
        "additionalProperties": false,
        "properties": {
          "max_accounts": {
            "format": "int32",
            "type": "integer"
          },
          "max_disk_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "max_accounts",
          "max_disk_bytes",
          "max_sites"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "ResellerLimitsView": {
        "additionalProperties": false,
        "properties": {
          "limits": {
            "$ref": "#/components/schemas/ResellerLimitsValues",
            "description": "null until an admin sets them (the reseller may own nothing until then)."
          },
          "usage": {
            "$ref": "#/components/schemas/Usage",
            "description": "Allocations: accounts, summed effective quota, summed effective max_sites."
          }
        },
        "required": [
          "limits",
          "usage"
        ],
        "type": "object"
      },
      "ResourceInfo": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "The resource of the scopes \u003cname\u003e:read and \u003cname\u003e:write.",
            "type": "string"
          },
          "read": {
            "description": "Permissions covered by \u003cname\u003e:read (and, on GET requests, the write permissions that are not strict).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "strict": {
            "description": "Write permissions whose reads also need \u003cname\u003e:write (secrets, files, backup downloads).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "write": {
            "description": "Permissions covered by \u003cname\u003e:write.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "read",
          "write",
          "strict"
        ],
        "type": "object"
      },
      "RetentionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "central_available": {
            "type": "boolean"
          },
          "central_enabled": {
            "type": "boolean"
          },
          "edition": {
            "type": "string"
          },
          "logs_days": {
            "format": "int64",
            "type": "integer"
          },
          "metrics_days": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "edition",
          "metrics_days",
          "logs_days",
          "central_available",
          "central_enabled"
        ],
        "type": "object"
      },
      "RetentionView": {
        "additionalProperties": false,
        "properties": {
          "daily": {
            "format": "int64",
            "maximum": 90,
            "minimum": 1,
            "type": "integer"
          },
          "monthly": {
            "format": "int64",
            "maximum": 36,
            "minimum": 0,
            "type": "integer"
          },
          "weekly": {
            "format": "int64",
            "maximum": 52,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "daily"
        ],
        "type": "object"
      },
      "RevokeOutputBody": {
        "additionalProperties": false,
        "properties": {
          "connection_dropped": {
            "type": "boolean"
          },
          "revoked_certificates": {
            "format": "int64",
            "type": "integer"
          },
          "server": {
            "$ref": "#/components/schemas/ServerView"
          }
        },
        "required": [
          "server",
          "revoked_certificates",
          "connection_dropped"
        ],
        "type": "object"
      },
      "RevokedOutputBody": {
        "additionalProperties": false,
        "properties": {
          "revoked": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "revoked"
        ],
        "type": "object"
      },
      "RingView": {
        "additionalProperties": false,
        "properties": {
          "counts": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "type": "object"
          },
          "last_confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "enum": [
              "internal",
              "canary",
              "wave_10",
              "wave_50",
              "wave_100"
            ],
            "type": "string"
          },
          "observation_seconds": {
            "format": "int32",
            "type": "integer"
          },
          "ring": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "enum": [
              "done",
              "current",
              "waiting",
              "empty"
            ],
            "type": "string"
          }
        },
        "required": [
          "ring",
          "name",
          "observation_seconds",
          "status",
          "counts",
          "last_confirmed_at"
        ],
        "type": "object"
      },
      "RollbackSiteInputBody": {
        "additionalProperties": false,
        "properties": {
          "snapshot_ts": {
            "description": "One of the site's snapshots (GET /sites/{id}).",
            "examples": [
              "20260929T183000Z"
            ],
            "type": "string"
          }
        },
        "required": [
          "snapshot_ts"
        ],
        "type": "object"
      },
      "RolloutDetailView": {
        "additionalProperties": false,
        "properties": {
          "events": {
            "description": "Newest first, at most 200.",
            "items": {
              "$ref": "#/components/schemas/RolloutEventView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rings": {
            "items": {
              "$ref": "#/components/schemas/RingView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rollout": {
            "$ref": "#/components/schemas/RolloutView"
          },
          "targets": {
            "items": {
              "$ref": "#/components/schemas/TargetView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "rollout",
          "rings",
          "targets",
          "events"
        ],
        "type": "object"
      },
      "RolloutEventView": {
        "additionalProperties": false,
        "properties": {
          "actor_user_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "from_state": {
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "kind": {
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "to_state": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "server_id",
          "kind",
          "from_state",
          "to_state",
          "detail",
          "actor_user_id",
          "created_at"
        ],
        "type": "object"
      },
      "RolloutReleaseView": {
        "additionalProperties": false,
        "properties": {
          "digest": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "routine",
              "security"
            ],
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "version",
          "digest",
          "kind"
        ],
        "type": "object"
      },
      "RolloutView": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "component": {
            "enum": [
              "pluspanel-os",
              "pluspanel-agent"
            ],
            "type": "string"
          },
          "counts": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "description": "Targets per state (pending, scheduled, updating, observing, passed, failed, rolling_back, rolled_back, rollback_failed, skipped) and total.",
            "type": "object"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by_user_id": {
            "description": "Null: started by the release watcher.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "current_ring": {
            "format": "int32",
            "maximum": 4,
            "minimum": 0,
            "type": "integer"
          },
          "current_ring_name": {
            "enum": [
              "internal",
              "canary",
              "wave_10",
              "wave_50",
              "wave_100"
            ],
            "type": "string"
          },
          "express": {
            "type": "boolean"
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "halted_reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "max_parallel": {
            "format": "int32",
            "type": "integer"
          },
          "notify_lead_seconds": {
            "format": "int32",
            "type": "integer"
          },
          "observation_seconds": {
            "description": "Per ring: internal, canary, wave 10 %, wave 50 %, wave 100 %.",
            "items": {
              "format": "int32",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "release": {
            "$ref": "#/components/schemas/RolloutReleaseView"
          },
          "state": {
            "enum": [
              "running",
              "paused",
              "halted",
              "cancelled",
              "completed",
              "superseded"
            ],
            "type": "string"
          },
          "superseded_by": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "release",
          "component",
          "channel",
          "state",
          "express",
          "observation_seconds",
          "notify_lead_seconds",
          "max_parallel",
          "current_ring",
          "current_ring_name",
          "halted_reason",
          "superseded_by",
          "created_by_user_id",
          "counts",
          "created_at",
          "updated_at",
          "finished_at"
        ],
        "type": "object"
      },
      "RotateAPIKeyInputBody": {
        "additionalProperties": false,
        "properties": {
          "grace_seconds": {
            "description": "How long the old token keeps working (0: stops at once).",
            "format": "int64",
            "maximum": 86400,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "RotateWebhookSecretInputBody": {
        "additionalProperties": false,
        "properties": {
          "grace_seconds": {
            "description": "How long the previous secret keeps signing too (0: it stops at once).",
            "format": "int64",
            "maximum": 86400,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "ScopeWildcard": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          }
        },
        "required": [
          "scope",
          "description"
        ],
        "type": "object"
      },
      "SecurityIssueView": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "waf_ingress_updating: the ingress image has no WAF and the platform reloads the ingress with the catalog's stable image (at most every 30 minutes); waf_unsupported_ingress: the catalog's stable ingress is the image running and it has no WAF, policies that need the WAF wait.",
            "enum": [
              "waf_ingress_updating",
              "waf_unsupported_ingress"
            ],
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "SecurityOverviewOutputBody": {
        "additionalProperties": false,
        "properties": {
          "default_mode": {
            "enum": [
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          },
          "geo_db_version": {
            "type": "string"
          },
          "mode_counts": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "description": "Sites per WAF mode (off, detect, block).",
            "type": "object"
          },
          "recent_blocks": {
            "description": "The 20 most recent blocked requests.",
            "items": {
              "$ref": "#/components/schemas/WAFEventView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "servers": {
            "items": {
              "$ref": "#/components/schemas/SecurityServerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sites": {
            "description": "At most 1000.",
            "items": {
              "$ref": "#/components/schemas/SecuritySiteView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "servers",
          "sites",
          "mode_counts",
          "recent_blocks",
          "default_mode",
          "geo_db_version"
        ],
        "type": "object"
      },
      "SecurityPolicyView": {
        "additionalProperties": false,
        "properties": {
          "mfa_forced": {
            "description": "The operator organization: MFA is always required for everyone.",
            "type": "boolean"
          },
          "mfa_required": {
            "description": "Who must use a second factor (effective value).",
            "enum": [
              "none",
              "admins",
              "all"
            ],
            "type": "string"
          },
          "notify_new_login": {
            "description": "E-mail users about sign-ins from new devices (when SMTP is configured).",
            "type": "boolean"
          },
          "password_deny_common": {
            "description": "Refuse the 10 000 most common passwords.",
            "type": "boolean"
          },
          "password_min_length": {
            "format": "int64",
            "maximum": 128,
            "minimum": 12,
            "type": "integer"
          },
          "updated_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "mfa_required",
          "mfa_forced",
          "password_min_length",
          "password_deny_common",
          "notify_new_login",
          "updated_at"
        ],
        "type": "object"
      },
      "SecurityServerView": {
        "additionalProperties": false,
        "properties": {
          "bans": {
            "format": "int32",
            "type": "integer"
          },
          "crs_version": {
            "type": "string"
          },
          "geo_db_version": {
            "type": "string"
          },
          "input_policy_drop": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "no_inbound_management": {
            "type": "boolean"
          },
          "reported_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "rule_count": {
            "format": "int32",
            "type": "integer"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "supported": {
            "type": "boolean"
          },
          "waf_engine": {
            "type": "string"
          }
        },
        "required": [
          "server_id",
          "name",
          "status",
          "supported",
          "no_inbound_management",
          "input_policy_drop",
          "rule_count",
          "bans",
          "waf_engine",
          "crs_version",
          "geo_db_version",
          "reported_at"
        ],
        "type": "object"
      },
      "SecuritySiteView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "blocked_24h": {
            "format": "int32",
            "type": "integer"
          },
          "detected_24h": {
            "format": "int32",
            "type": "integer"
          },
          "live_waf_mode": {
            "description": "As the agent reports it (empty: not reported).",
            "enum": [
              "",
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          },
          "primary_domain": {
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "site_id": {
            "format": "uuid",
            "type": "string"
          },
          "waf_mode": {
            "enum": [
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          }
        },
        "required": [
          "site_id",
          "primary_domain",
          "account_id",
          "server_id",
          "waf_mode",
          "live_waf_mode",
          "blocked_24h",
          "detected_24h"
        ],
        "type": "object"
      },
      "SensitiveOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "format": "uuid",
            "type": "string"
          },
          "sensitive": {
            "description": "The secret member of the job result, e.g. {\"admin_password\":\"...\"}. Shown once."
          }
        },
        "required": [
          "job_id",
          "sensitive"
        ],
        "type": "object"
      },
      "ServerDetailView": {
        "additionalProperties": false,
        "properties": {
          "acme": {
            "$ref": "#/components/schemas/AcmeStatusView",
            "description": "The TLS engine's ACME settings as the agent last reported them (M11); null while the agent reports none (it then has no TLS engine and refuses TLS commands)."
          },
          "agent_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "channel_explicit": {
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "enrolled_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "ingress": {
            "$ref": "#/components/schemas/IngressStatusView",
            "description": "The host ingress as the agent last reported it (M10); null until reported."
          },
          "lab": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "os_image_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "os_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "public_ipv4": {
            "type": [
              "string",
              "null"
            ]
          },
          "public_ipv6": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "update_ring_internal": {
            "type": "boolean"
          },
          "update_status": {
            "$ref": "#/components/schemas/UpdateStatusView",
            "description": "The agent's update state as last reported (M06e); null for agents before update orchestration."
          }
        },
        "required": [
          "ingress",
          "acme",
          "update_status",
          "id",
          "name",
          "status",
          "channel",
          "enrolled_at",
          "agent_version",
          "os_version",
          "os_image_digest",
          "lab",
          "channel_explicit",
          "update_ring_internal",
          "public_ipv4",
          "public_ipv6",
          "created_at"
        ],
        "type": "object"
      },
      "ServerOSUpdateView": {
        "additionalProperties": false,
        "properties": {
          "confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "type": [
              "string",
              "null"
            ]
          },
          "expected_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "image_ref": {
            "type": [
              "string",
              "null"
            ]
          },
          "job_id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "apply",
              "rollback"
            ],
            "type": "string"
          },
          "observed_os_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "previous_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "staged_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "staged_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "awaiting_reboot",
              "confirmed",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "job_id",
          "reason",
          "created_at",
          "kind",
          "status",
          "image_ref",
          "expected_digest",
          "previous_digest",
          "staged_digest",
          "detail",
          "observed_os_version",
          "staged_at",
          "confirmed_at"
        ],
        "type": "object"
      },
      "ServerPolicyBody": {
        "additionalProperties": false,
        "properties": {
          "brute_force": {
            "$ref": "#/components/schemas/BruteForceBody"
          },
          "countries": {
            "description": "ISO 3166-1 alpha-2 codes. IP Geolocation by DB-IP (CC BY 4.0).",
            "items": {
              "type": "string"
            },
            "maxItems": 250,
            "type": [
              "array",
              "null"
            ]
          },
          "geo_mode": {
            "default": "none",
            "description": "Country rule for every workload service (nftables).",
            "enum": [
              "none",
              "deny",
              "allow"
            ],
            "type": "string"
          },
          "rules": {
            "description": "Inbound workload traffic only: management is outbound and never matched.",
            "items": {
              "$ref": "#/components/schemas/FirewallRuleBody"
            },
            "maxItems": 1000,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "rules",
          "brute_force"
        ],
        "type": "object"
      },
      "ServerSecurityView": {
        "additionalProperties": false,
        "properties": {
          "applied_sha256": {
            "description": "What the agent reports (empty: never set).",
            "type": "string"
          },
          "desired_sha256": {
            "type": "string"
          },
          "geo_db_version": {
            "type": "string"
          },
          "in_sync": {
            "type": "boolean"
          },
          "ingress_issue": {
            "$ref": "#/components/schemas/SecurityIssueView",
            "description": "The ingress reports no WAF while a site on the server needs it; null: no problem."
          },
          "pending_job_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "policy": {
            "$ref": "#/components/schemas/ServerPolicyBody"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "supported": {
            "type": "boolean"
          }
        },
        "required": [
          "server_id",
          "supported",
          "policy",
          "desired_sha256",
          "applied_sha256",
          "in_sync",
          "pending_job_id",
          "geo_db_version",
          "ingress_issue"
        ],
        "type": "object"
      },
      "ServerSettings": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "tier": {
            "type": "string"
          },
          "window_minutes": {
            "format": "int64",
            "type": "integer"
          },
          "window_start_minute": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "tier",
          "window_start_minute",
          "window_minutes"
        ],
        "type": "object"
      },
      "ServerStorageOutputBody": {
        "additionalProperties": false,
        "properties": {
          "ready": {
            "description": "True when the agent reports READY: accounts can be provisioned. Provisioning is not refused otherwise; the agent answers storage_not_ready.",
            "type": "boolean"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "$ref": "#/components/schemas/StorageStatusView",
            "description": "Null until the agent reports a StorageInit outcome."
          }
        },
        "required": [
          "server_id",
          "ready",
          "status"
        ],
        "type": "object"
      },
      "ServerTargetView": {
        "additionalProperties": false,
        "properties": {
          "attempt": {
            "format": "int32",
            "type": "integer"
          },
          "channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "component": {
            "enum": [
              "pluspanel-os",
              "pluspanel-agent"
            ],
            "type": "string"
          },
          "confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "failure_reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "passed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "release_digest": {
            "type": "string"
          },
          "release_version": {
            "type": "string"
          },
          "rollout_id": {
            "format": "uuid",
            "type": "string"
          },
          "rollout_state": {
            "type": "string"
          },
          "scheduled_for": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "skip_reason": {
            "type": [
              "string",
              "null"
            ]
          },
          "started_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "rollout_id",
          "component",
          "channel",
          "rollout_state",
          "release_version",
          "release_digest",
          "state",
          "skip_reason",
          "failure_reason",
          "attempt",
          "scheduled_for",
          "started_at",
          "confirmed_at",
          "passed_at",
          "finished_at",
          "updated_at"
        ],
        "type": "object"
      },
      "ServerTelemetryCfg": {
        "additionalProperties": false,
        "properties": {
          "disk_cap_bytes": {
            "description": "0 = default (2 GiB); otherwise 256 MiB..1 TiB.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "local_logs_retention_days": {
            "description": "0 = default (3).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          },
          "local_metrics_retention_days": {
            "description": "0 = default (7).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "disk_cap_bytes",
          "local_metrics_retention_days",
          "local_logs_retention_days"
        ],
        "type": "object"
      },
      "ServerTelemetrySettings": {
        "additionalProperties": false,
        "properties": {
          "disk_cap_bytes": {
            "description": "0 = default (2 GiB); otherwise 256 MiB..1 TiB.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "local_logs_retention_days": {
            "description": "0 = default (3).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          },
          "local_metrics_retention_days": {
            "description": "0 = default (7).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          },
          "name": {
            "readOnly": true,
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "server_id",
          "disk_cap_bytes",
          "local_metrics_retention_days",
          "local_logs_retention_days"
        ],
        "type": "object"
      },
      "ServerTelemetrySettingsInput": {
        "additionalProperties": false,
        "properties": {
          "disk_cap_bytes": {
            "description": "0 = default (2 GiB); otherwise 256 MiB..1 TiB.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "local_logs_retention_days": {
            "description": "0 = default (3).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          },
          "local_metrics_retention_days": {
            "description": "0 = default (7).",
            "format": "int32",
            "maximum": 30,
            "minimum": 0,
            "type": "integer"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "server_id"
        ],
        "type": "object"
      },
      "ServerUpdatesView": {
        "additionalProperties": false,
        "properties": {
          "agent_updates": {
            "items": {
              "$ref": "#/components/schemas/AgentUpdateView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "channel_explicit": {
            "description": "false: the server follows the organization's default.",
            "type": "boolean"
          },
          "cleanups": {
            "items": {
              "$ref": "#/components/schemas/CleanupView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "default_channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "os_updates": {
            "items": {
              "$ref": "#/components/schemas/ServerOSUpdateView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "pending_channel": {
            "description": "A set_update_channel job in flight.",
            "type": [
              "string",
              "null"
            ]
          },
          "rollouts": {
            "items": {
              "$ref": "#/components/schemas/ServerTargetView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "update_ring_internal": {
            "type": "boolean"
          },
          "update_status": {
            "$ref": "#/components/schemas/UpdateStatusView",
            "description": "Null: the agent predates update orchestration."
          }
        },
        "required": [
          "server_id",
          "channel",
          "channel_explicit",
          "default_channel",
          "pending_channel",
          "update_ring_internal",
          "update_status",
          "os_updates",
          "agent_updates",
          "rollouts",
          "cleanups"
        ],
        "type": "object"
      },
      "ServerView": {
        "additionalProperties": false,
        "properties": {
          "agent_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "channel_explicit": {
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "enrolled_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "lab": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "os_image_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "os_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "public_ipv4": {
            "type": [
              "string",
              "null"
            ]
          },
          "public_ipv6": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "update_ring_internal": {
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "channel",
          "enrolled_at",
          "agent_version",
          "os_version",
          "os_image_digest",
          "lab",
          "channel_explicit",
          "update_ring_internal",
          "public_ipv4",
          "public_ipv6",
          "created_at"
        ],
        "type": "object"
      },
      "ServerWindowOutputBody": {
        "additionalProperties": false,
        "properties": {
          "effective": {
            "description": "none: updates may run any time.",
            "enum": [
              "server",
              "organization",
              "none"
            ],
            "type": "string"
          },
          "next_opening": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "organization": {
            "$ref": "#/components/schemas/WindowView",
            "description": "The organization's default window (null: none)."
          },
          "window": {
            "$ref": "#/components/schemas/WindowView",
            "description": "The server's own window (null: none)."
          }
        },
        "required": [
          "window",
          "organization",
          "effective",
          "next_opening"
        ],
        "type": "object"
      },
      "ServiceEnvVar": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "PLUSPANEL_* and PODMAN_* are reserved.",
            "pattern": "^[A-Z_][A-Z0-9_]{0,63}$",
            "type": "string"
          },
          "value": {
            "description": "Printable UTF-8 without control characters, at most 1024 bytes.",
            "maxLength": 1024,
            "type": "string"
          }
        },
        "required": [
          "name",
          "value"
        ],
        "type": "object"
      },
      "ServiceListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ServiceView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ServiceLiveView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "health": {
            "enum": [
              "unspecified",
              "healthy",
              "unhealthy",
              "starting"
            ],
            "type": "string"
          },
          "host_address": {
            "description": "Host address the service is published on.",
            "examples": [
              "127.64.0.1:8080"
            ],
            "type": "string"
          },
          "image_digest": {
            "description": "Manifest digest the container runs.",
            "type": "string"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "restarts": {
            "description": "Restarts by systemd since the unit was started.",
            "format": "int64",
            "type": "integer"
          },
          "state": {
            "enum": [
              "unspecified",
              "starting",
              "running",
              "stopped",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "state",
          "health",
          "restarts",
          "image_digest",
          "host_address",
          "detail",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "ServiceView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "catalog_image": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "digest": {
            "description": "Digest resolved at deploy time; the agent verifies it.",
            "type": "string"
          },
          "env": {
            "items": {
              "$ref": "#/components/schemas/ServiceEnvVar"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_error": {
            "type": [
              "string",
              "null"
            ]
          },
          "last_error_code": {
            "description": "Agent error code of the last failed operation (runtime_invalid_argument, runtime_account_not_found, runtime_not_ready, runtime_image_rejected, runtime_image_pull_failed, runtime_digest_mismatch, runtime_service_not_found, runtime_host_error) or job_failed / job_dead / job_cancelled.",
            "examples": [
              "runtime_image_pull_failed"
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "last_job_id": {
            "description": "Most recent job of this service; null while a deploy waits for the account runtime.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "live": {
            "$ref": "#/components/schemas/ServiceLiveView",
            "description": "Container status from the latest heartbeat; null until reported (and for removed services)."
          },
          "mounts_profile": {
            "enum": [
              "static",
              "php"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "removed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "status": {
            "enum": [
              "deploying",
              "running",
              "failed",
              "restarting",
              "removing",
              "removed"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "server_id",
          "account_id",
          "name",
          "catalog_image",
          "digest",
          "mounts_profile",
          "env",
          "status",
          "last_job_id",
          "last_error_code",
          "last_error",
          "created_at",
          "updated_at",
          "removed_at",
          "live"
        ],
        "type": "object"
      },
      "SessionView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "current": {
            "description": "The session of this request.",
            "type": "boolean"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "ip": {
            "type": [
              "string",
              "null"
            ]
          },
          "last_seen_at": {
            "format": "date-time",
            "type": "string"
          },
          "mfa_method": {
            "enum": [
              "totp",
              "recovery",
              "webauthn",
              "passkey",
              null
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "mfa_pending": {
            "type": "boolean"
          },
          "user_agent": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "created_at",
          "last_seen_at",
          "expires_at",
          "ip",
          "user_agent",
          "mfa_method",
          "mfa_pending",
          "current"
        ],
        "type": "object"
      },
      "SessionsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/SessionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "SetAccountWAFInputBody": {
        "additionalProperties": false,
        "properties": {
          "mode": {
            "enum": [
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          }
        },
        "required": [
          "mode"
        ],
        "type": "object"
      },
      "SetAccountWAFOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_ids": {
            "description": "Pushes enqueued now (sites of an agent without a security engine get none).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sites": {
            "description": "Sites of the account set to the mode.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "sites",
          "job_ids"
        ],
        "type": "object"
      },
      "SetBrandingInputBody": {
        "additionalProperties": false,
        "properties": {
          "accent_color": {
            "type": "string"
          },
          "primary_color": {
            "description": "#RRGGBB; white text on it must reach 4.5:1 (WCAG AA).",
            "type": "string"
          },
          "product_name": {
            "maxLength": 60,
            "type": "string"
          },
          "support_email": {
            "maxLength": 254,
            "type": "string"
          },
          "support_url": {
            "maxLength": 300,
            "type": "string"
          },
          "terminology": {
            "additionalProperties": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "description": "Per locale (ro, en, es): translation key → text (≤ 200 entries, ≤ 200 characters each).",
            "type": "object"
          }
        },
        "type": "object"
      },
      "SetDNSSECInputBody": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "SetDSPublishedInputBody": {
        "additionalProperties": false,
        "properties": {
          "published": {
            "description": "true once the DS is at the parent (registrar or parent zone); false after removing it there.",
            "type": "boolean"
          }
        },
        "required": [
          "published"
        ],
        "type": "object"
      },
      "SetEditionInputBody": {
        "additionalProperties": false,
        "properties": {
          "edition": {
            "enum": [
              "free",
              "pro",
              "enterprise"
            ],
            "type": "string"
          }
        },
        "required": [
          "edition"
        ],
        "type": "object"
      },
      "SetLogoInputBody": {
        "additionalProperties": false,
        "properties": {
          "image": {
            "contentEncoding": "base64",
            "description": "base64 of a PNG or JPEG, at most 128 KiB and 1024×1024.",
            "type": "string"
          }
        },
        "required": [
          "image"
        ],
        "type": "object"
      },
      "SetMailServerInputBody": {
        "additionalProperties": false,
        "properties": {
          "acme_production": {
            "description": "Mail certificates from the Let's Encrypt production endpoint (default true).",
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "hostname": {
            "description": "Required when enabled, e.g. mx1.example.net (never a mail domain or one of its web names).",
            "maxLength": 253,
            "type": "string"
          },
          "outgoing": {
            "description": "Default platform.",
            "enum": [
              "platform",
              "custom",
              "direct",
              "none",
              ""
            ],
            "type": "string"
          },
          "smarthost": {
            "$ref": "#/components/schemas/SmarthostStruct",
            "description": "Required with outgoing custom."
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "SetPanelHostInputBody": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "description": "The panel's host name, e.g. panel.example.ro (IDNA names are converted to A-labels).",
            "maxLength": 253,
            "minLength": 1,
            "type": "string"
          },
          "manage_dns": {
            "description": "When the host lies in a DNS zone of this organization, create its A/AAAA records.",
            "type": "boolean"
          }
        },
        "required": [
          "host"
        ],
        "type": "object"
      },
      "SetSecurityPolicyInputBody": {
        "additionalProperties": false,
        "properties": {
          "mfa_required": {
            "enum": [
              "none",
              "admins",
              "all"
            ],
            "type": "string"
          },
          "notify_new_login": {
            "type": "boolean"
          },
          "password_deny_common": {
            "type": "boolean"
          },
          "password_min_length": {
            "format": "int64",
            "maximum": 128,
            "minimum": 12,
            "type": "integer"
          }
        },
        "required": [
          "mfa_required",
          "password_min_length",
          "password_deny_common",
          "notify_new_login"
        ],
        "type": "object"
      },
      "SetServerAddressesInputBody": {
        "additionalProperties": false,
        "properties": {
          "public_ipv4": {
            "description": "Empty clears it.",
            "type": "string"
          },
          "public_ipv6": {
            "description": "Empty clears it.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "SetServerLabInputBody": {
        "additionalProperties": false,
        "properties": {
          "lab": {
            "description": "true: the server accepts the destructive drill probes (fork_bomb, memory_hog, fill_bytes, connect, fill_inodes).",
            "type": "boolean"
          }
        },
        "required": [
          "lab"
        ],
        "type": "object"
      },
      "SetServerSftpInputBody": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "SetServerSftpOutputBody": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "enabled": {
            "description": "what the admin asked for (default false)",
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "host_key_fingerprint": {
            "type": "string"
          },
          "job_id": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "reported_enabled": {
            "type": "boolean"
          },
          "running": {
            "type": "boolean"
          },
          "supported": {
            "description": "the agent reports SFTP (M14)",
            "type": "boolean"
          },
          "users": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "job_id",
          "enabled",
          "supported",
          "running",
          "reported_enabled",
          "port",
          "users"
        ],
        "type": "object"
      },
      "SetSftpKeysInputBody": {
        "additionalProperties": false,
        "properties": {
          "public_keys": {
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "public_keys"
        ],
        "type": "object"
      },
      "SetSiteDomainsInputBody": {
        "additionalProperties": false,
        "properties": {
          "aliases": {
            "description": "Additional host names, at most 20; none twice.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "manage_dns": {
            "description": "Manage DNS here (M12): for every name that lies in a DNS zone of the tenant, replace the site's A/AAAA records (www.\u003capex\u003e as a CNAME when the apex is a name too) pointing at the server's public addresses. 422 dns_zone_missing when no name lies in a zone, 409 server_addresses_missing, 409 record_conflict when a record of the zone is in the way (a CNAME at one of the names). Needs dns.manage too.",
            "type": "boolean"
          },
          "primary_domain": {
            "description": "Same rules as the launch's primary_domain (IDNs are converted to their A-label).",
            "type": "string"
          }
        },
        "required": [
          "primary_domain",
          "aliases"
        ],
        "type": "object"
      },
      "SetSitePHPVersionInputBody": {
        "additionalProperties": false,
        "properties": {
          "force_health_failure": {
            "description": "Drill hook: the health check after the switch fails on purpose so the automatic rollback runs. Lab servers and holders of jobs.test_probes only (403 otherwise).",
            "type": "boolean"
          },
          "php_version": {
            "description": "A version of GET /php-versions that is not disabled.",
            "examples": [
              "8.4"
            ],
            "type": "string"
          }
        },
        "required": [
          "php_version"
        ],
        "type": "object"
      },
      "SetSiteTLSInputBody": {
        "additionalProperties": false,
        "properties": {
          "acme_production": {
            "description": "auto and dns: true = Let's Encrypt production (publicly trusted, rate limited), false = staging (untrusted test certificates). Omitted: the site's current choice, else the server default.",
            "type": "boolean"
          },
          "mode": {
            "description": "auto, off or dns. custom is refused (422 tls_use_import): import a certificate instead. dns (M12): the platform orders the certificate over DNS-01 from its own nameservers (every name must lie in a DNS zone of the tenant) and delivers it as an import; wildcards are possible.",
            "type": "string"
          },
          "wildcard": {
            "description": "dns only: order *.\u003czone of the primary\u003e instead of the names it covers. Omitted: the site's current choice.",
            "type": "boolean"
          }
        },
        "required": [
          "mode"
        ],
        "type": "object"
      },
      "SetTLSTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "backoff_base_seconds": {
            "description": "First retry delay after a failure (0: the default, 10 min); at most one day.",
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "break_http01": {
            "description": "Leave the HTTP-01 challenge route out of the ingress configuration, so validation fails.",
            "type": "boolean"
          },
          "check_interval_seconds": {
            "description": "Seconds between renewal checks (0: the default, 12 h); 10 to 604800.",
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          },
          "renew_before_seconds": {
            "description": "Renew when a certificate expires within this many seconds (0: the default, 30 days); at most one year.",
            "format": "int32",
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "SftpStatusView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "enabled": {
            "description": "what the admin asked for (default false)",
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "host_key_fingerprint": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "reported_enabled": {
            "type": "boolean"
          },
          "running": {
            "type": "boolean"
          },
          "supported": {
            "description": "the agent reports SFTP (M14)",
            "type": "boolean"
          },
          "users": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "supported",
          "running",
          "reported_enabled",
          "port",
          "users"
        ],
        "type": "object"
      },
      "SftpUserJobOutputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "has_password": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "job_id": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "last_login_at": {
            "format": "date-time",
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "public_keys": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sftp_enabled": {
            "type": "boolean"
          },
          "state": {
            "enum": [
              "pending",
              "active",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "job_id",
          "account_id",
          "username",
          "state",
          "public_keys",
          "has_password",
          "port",
          "sftp_enabled"
        ],
        "type": "object"
      },
      "SftpUserView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "has_password": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "last_job_id": {
            "type": "string"
          },
          "last_login_at": {
            "format": "date-time",
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "public_keys": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sftp_enabled": {
            "type": "boolean"
          },
          "state": {
            "enum": [
              "pending",
              "active",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "account_id",
          "username",
          "state",
          "public_keys",
          "has_password",
          "port",
          "sftp_enabled"
        ],
        "type": "object"
      },
      "SilenceView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "active": {
            "type": "boolean"
          },
          "comment": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_by": {
            "type": [
              "string",
              "null"
            ]
          },
          "ends_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "rule": {
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "type": [
              "string",
              "null"
            ]
          },
          "starts_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "rule",
          "server_id",
          "account_id",
          "starts_at",
          "ends_at",
          "comment",
          "created_by",
          "created_at",
          "active"
        ],
        "type": "object"
      },
      "SilencesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/SilenceView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "SiteActionOutputBody": {
        "additionalProperties": false,
        "properties": {
          "job_id": {
            "description": "Poll GET /jobs/{id}. A launch's one-time admin password is read with GET /jobs/{job_id}/sensitive once the job succeeded. Empty when the change enqueued no job (TLS mode dns: the platform orders the certificate, see tls.dns01).",
            "type": "string"
          },
          "site": {
            "$ref": "#/components/schemas/SiteView"
          }
        },
        "required": [
          "site",
          "job_id"
        ],
        "type": "object"
      },
      "SiteBindingInputBody": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "description": "Empty for redis.",
            "type": "string"
          },
          "service_id": {
            "format": "uuid",
            "type": "string"
          },
          "user": {
            "description": "A user of the service with a grant on the database.",
            "type": "string"
          }
        },
        "required": [
          "service_id",
          "user"
        ],
        "type": "object"
      },
      "SiteBindingOutputBody": {
        "additionalProperties": false,
        "properties": {
          "binding": {
            "$ref": "#/components/schemas/DBBindingView"
          },
          "job_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "binding",
          "job_id"
        ],
        "type": "object"
      },
      "SiteBindingsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DBBindingView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "SiteContainerView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "health": {
            "examples": [
              "healthy"
            ],
            "type": "string"
          },
          "host_address": {
            "description": "Loopback address:port the container is published on; empty for the database (never published).",
            "type": "string"
          },
          "image_digest": {
            "type": "string"
          },
          "name": {
            "examples": [
              "svc-0123456789ab-web"
            ],
            "type": "string"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "restarts": {
            "format": "int64",
            "type": "integer"
          },
          "role": {
            "enum": [
              "web",
              "db"
            ],
            "type": "string"
          },
          "state": {
            "examples": [
              "running"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "role",
          "state",
          "health",
          "restarts",
          "image_digest",
          "host_address",
          "detail",
          "reported_at"
        ],
        "type": "object"
      },
      "SiteDetailOutputBody": {
        "additionalProperties": false,
        "properties": {
          "containers": {
            "description": "Live web and database containers from the latest heartbeat (empty until reported).",
            "items": {
              "$ref": "#/components/schemas/SiteContainerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "jobs": {
            "description": "Most recent first (at most 10).",
            "items": {
              "$ref": "#/components/schemas/SiteJobView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "site": {
            "$ref": "#/components/schemas/SiteView"
          },
          "snapshots": {
            "description": "Newest first, mirrored from heartbeats.",
            "items": {
              "$ref": "#/components/schemas/SiteSnapshotView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "site",
          "snapshots",
          "containers",
          "jobs"
        ],
        "type": "object"
      },
      "SiteDomainsView": {
        "additionalProperties": false,
        "properties": {
          "aliases": {
            "description": "At most 20, sorted.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "primary": {
            "examples": [
              "blog.example.com"
            ],
            "type": "string"
          }
        },
        "required": [
          "primary",
          "aliases"
        ],
        "type": "object"
      },
      "SiteJobView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "job_id": {
            "format": "uuid",
            "type": "string"
          },
          "kind": {
            "enum": [
              "deploy",
              "wp_cli",
              "snapshot",
              "rollback",
              "remove",
              "domains",
              "php_version",
              "tls_policy",
              "tls_import",
              "tls_renew"
            ],
            "type": "string"
          },
          "last_error": {
            "type": [
              "string",
              "null"
            ]
          },
          "mutating": {
            "type": "boolean"
          },
          "operation": {
            "description": "WP-CLI operation of a wp_cli job.",
            "type": "string"
          },
          "result": {
            "additionalProperties": {},
            "description": "Agent-reported outcome. Generated passwords are never part of it (GET /jobs/{id}/sensitive).",
            "type": [
              "object",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "leased",
              "dispatched",
              "acked",
              "succeeded",
              "failed",
              "dead",
              "cancelled"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "job_id",
          "kind",
          "operation",
          "mutating",
          "status",
          "created_at",
          "updated_at",
          "last_error",
          "result"
        ],
        "type": "object"
      },
      "SiteListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/SiteView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "SiteLiveView": {
        "additionalProperties": false,
        "properties": {
          "domains": {
            "description": "Host names the ingress routes to the site, primary first; empty until reported.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ingress_port": {
            "description": "Loopback port the ingress forwards to; 0 when not routed.",
            "format": "int32",
            "type": "integer"
          },
          "php_version": {
            "description": "PHP version the web container runs; empty until reported.",
            "type": "string"
          }
        },
        "required": [
          "domains",
          "php_version",
          "ingress_port"
        ],
        "type": "object"
      },
      "SitePolicyBody": {
        "additionalProperties": false,
        "properties": {
          "basic_headers": {
            "description": "X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, X-Frame-Options SAMEORIGIN.",
            "type": "boolean"
          },
          "countries": {
            "description": "ISO 3166-1 alpha-2 codes (GET /geoip). IP Geolocation by DB-IP (CC BY 4.0).",
            "items": {
              "type": "string"
            },
            "maxItems": 250,
            "type": [
              "array",
              "null"
            ]
          },
          "csp": {
            "description": "Content-Security-Policy value: printable ASCII without '{' or '}' (422 csp_invalid); empty = none.",
            "maxLength": 4096,
            "type": "string"
          },
          "csp_report_only": {
            "description": "Send it as Content-Security-Policy-Report-Only.",
            "type": "boolean"
          },
          "geo_mode": {
            "default": "none",
            "description": "Country rule of the site, answered with 403 at the ingress.",
            "enum": [
              "none",
              "deny",
              "allow"
            ],
            "type": "string"
          },
          "hsts_include_subdomains": {
            "type": "boolean"
          },
          "hsts_max_age": {
            "description": "Strict-Transport-Security max-age in seconds; 0 = no header. Sent on HTTPS only.",
            "format": "int64",
            "maximum": 63072000,
            "minimum": 0,
            "type": "integer"
          },
          "hsts_preload": {
            "description": "Needs include_subdomains and a max-age of at least one year.",
            "type": "boolean"
          },
          "paranoia_level": {
            "description": "OWASP CRS paranoia level (1 = fewest false positives).",
            "format": "int64",
            "maximum": 4,
            "minimum": 1,
            "type": "integer"
          },
          "waf_mode": {
            "description": "off: no inspection; detect: log matches, never block (Coraza DetectionOnly); block: answer 403.",
            "enum": [
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          }
        },
        "required": [
          "waf_mode",
          "paranoia_level"
        ],
        "type": "object"
      },
      "SiteRollbackInputBody": {
        "additionalProperties": false,
        "properties": {
          "snapshot_id": {
            "description": "Default: the site's newest pre-update snapshot.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "SiteSecurityView": {
        "additionalProperties": false,
        "properties": {
          "applied": {
            "$ref": "#/components/schemas/AppliedSiteView",
            "description": "What the agent runs; null until reported."
          },
          "desired_sha256": {
            "description": "Hash of the policy the platform pushes (empty while it cannot be rendered).",
            "type": "string"
          },
          "exclusions": {
            "items": {
              "$ref": "#/components/schemas/WAFExclusionView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "geo_db_version": {
            "description": "Current GeoIP database version (empty: none imported).",
            "type": "string"
          },
          "in_sync": {
            "description": "The agent runs the desired policy.",
            "type": "boolean"
          },
          "ingress_issue": {
            "$ref": "#/components/schemas/SecurityIssueView",
            "description": "Why the site's WAF or country rule is not applied by the server's ingress; null: no problem."
          },
          "pending_job_id": {
            "description": "The push in flight, if any.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "policy": {
            "$ref": "#/components/schemas/SitePolicyBody"
          },
          "site_id": {
            "format": "uuid",
            "type": "string"
          },
          "supported": {
            "description": "The server's agent has a security engine; false: changes answer 409 security_unsupported_agent.",
            "type": "boolean"
          }
        },
        "required": [
          "site_id",
          "supported",
          "policy",
          "exclusions",
          "desired_sha256",
          "applied",
          "in_sync",
          "pending_job_id",
          "geo_db_version",
          "ingress_issue"
        ],
        "type": "object"
      },
      "SiteSnapshotView": {
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "format": "int64",
            "type": "integer"
          },
          "reason": {
            "type": "string"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "ts": {
            "examples": [
              "20260929T183000Z"
            ],
            "type": "string"
          },
          "wp_version": {
            "type": "string"
          }
        },
        "required": [
          "ts",
          "reason",
          "bytes",
          "wp_version",
          "reported_at"
        ],
        "type": "object"
      },
      "SiteTLSView": {
        "additionalProperties": false,
        "properties": {
          "acme_production": {
            "description": "ACME endpoint of an auto site: true production, false staging, null the server default (never set).",
            "type": [
              "boolean",
              "null"
            ]
          },
          "cert_status": {
            "description": "unknown until reported; none (off), pending (no certificate yet), ok, expiring (renewal due, a custom certificate within 30 days, or names not covered), error (last attempt failed or expired).",
            "enum": [
              "unknown",
              "none",
              "pending",
              "ok",
              "expiring",
              "error"
            ],
            "type": "string"
          },
          "detail": {
            "description": "Why the status is what it is (the last ACME error, renewal due, ...).",
            "type": "string"
          },
          "dns01": {
            "$ref": "#/components/schemas/DNS01OrderView",
            "description": "Mode dns: the latest certificate order of the platform."
          },
          "error": {
            "description": "Outcome of the last failed TLS change (error code: message); empty after a success.",
            "type": "string"
          },
          "failures": {
            "description": "Consecutive failed ACME attempts.",
            "format": "int32",
            "type": "integer"
          },
          "https_active": {
            "description": "HTTPS is served for the primary domain and HTTP redirects to it.",
            "type": "boolean"
          },
          "issuer": {
            "examples": [
              "(STAGING) Let's Encrypt / YE2"
            ],
            "type": "string"
          },
          "live_mode": {
            "description": "Policy the agent reports; empty until an agent with a TLS engine reports it.",
            "type": "string"
          },
          "mode": {
            "description": "Desired policy: auto (Let's Encrypt over HTTP-01 by the agent), off, custom (an imported certificate), dns (Let's Encrypt over DNS-01 by the platform, M12: the agent holds it as a custom certificate, so live_mode is custom). auto/off/custom change when a TLS job succeeds; dns is set at once and the certificate follows (dns01).",
            "enum": [
              "auto",
              "off",
              "custom",
              "dns"
            ],
            "type": "string"
          },
          "names": {
            "description": "Host names the certificate covers.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "next_attempt_at": {
            "description": "Next ACME attempt after a failure (backoff).",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "not_after": {
            "description": "Expiry of the served certificate.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "reported_at": {
            "description": "Heartbeat that reported the certificate state.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "wildcard": {
            "description": "Mode dns: the certificate has *.\u003czone\u003e instead of the names it covers.",
            "type": "boolean"
          }
        },
        "required": [
          "mode",
          "wildcard",
          "acme_production",
          "live_mode",
          "cert_status",
          "not_after",
          "issuer",
          "names",
          "detail",
          "https_active",
          "next_attempt_at",
          "failures",
          "reported_at",
          "error"
        ],
        "type": "object"
      },
      "SiteView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "admin_email": {
            "type": "string"
          },
          "admin_user": {
            "type": "string"
          },
          "busy": {
            "description": "A mutating job of this site is in flight: further mutations answer 409.",
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "detail": {
            "description": "Agent detail, or the error code of the last failed operation (e.g. wp_health_failed).",
            "type": "string"
          },
          "domains": {
            "$ref": "#/components/schemas/SiteDomainsView",
            "description": "The host names the site should answer on (desired state, reserved on the server)."
          },
          "domains_error": {
            "description": "Outcome of the last failed host-name change (error code: message); empty after a success.",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_snapshot_ts": {
            "description": "Newest snapshot (UTC), empty when none.",
            "examples": [
              "20260929T183000Z"
            ],
            "type": "string"
          },
          "live": {
            "$ref": "#/components/schemas/SiteLiveView",
            "description": "What the agent reports: routed host names, running PHP version, ingress port."
          },
          "locale": {
            "examples": [
              "en_US"
            ],
            "type": "string"
          },
          "php_error": {
            "description": "Outcome of the last failed PHP switch (e.g. wp_php_switch_failed: … rolled back); empty after a success.",
            "type": "string"
          },
          "php_version": {
            "description": "PHP version of the web container; changes when a PHP switch succeeds.",
            "examples": [
              "8.4"
            ],
            "type": "string"
          },
          "plugin_set_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "primary_domain": {
            "examples": [
              "blog.example.com"
            ],
            "type": "string"
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "site_key": {
            "description": "First 12 hex digits of the id: names the site's directories and services on the server.",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "installing",
              "active",
              "broken",
              "removing"
            ],
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "tls": {
            "$ref": "#/components/schemas/SiteTLSView",
            "description": "TLS policy and the certificate as the agent reports it."
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "url_checked": {
            "description": "URL of the agent's last health check.",
            "type": "string"
          },
          "wp_version": {
            "description": "Empty until installed.",
            "examples": [
              "6.9.1"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "server_id",
          "account_id",
          "primary_domain",
          "title",
          "status",
          "wp_version",
          "admin_user",
          "admin_email",
          "locale",
          "plugin_set_id",
          "site_key",
          "url_checked",
          "last_snapshot_ts",
          "detail",
          "busy",
          "domains",
          "php_version",
          "live",
          "domains_error",
          "php_error",
          "tls",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "SmarthostStruct": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "maxLength": 253,
            "type": "string"
          },
          "password": {
            "description": "Kept in the vault; absent keeps the stored one.",
            "maxLength": 1024,
            "type": "string"
          },
          "port": {
            "format": "int64",
            "maximum": 65535,
            "minimum": 1,
            "type": "integer"
          },
          "spf_include": {
            "description": "SPF include domain of the smarthost (empty: the SPF record ends in ~all).",
            "maxLength": 253,
            "type": "string"
          },
          "tls": {
            "description": "Default submissions (implicit TLS).",
            "enum": [
              "submissions",
              "starttls",
              ""
            ],
            "type": "string"
          },
          "username": {
            "maxLength": 128,
            "type": "string"
          }
        },
        "required": [
          "host",
          "port",
          "username"
        ],
        "type": "object"
      },
      "SnapshotSiteInputBody": {
        "additionalProperties": false,
        "properties": {
          "reason": {
            "description": "Free label, [a-z0-9 ._:-]{0,64} (default: manual).",
            "type": "string"
          }
        },
        "type": "object"
      },
      "StartImpersonationInputBody": {
        "additionalProperties": false,
        "properties": {
          "reason": {
            "description": "Why (support ticket, ...): recorded in the audit log.",
            "maxLength": 500,
            "minLength": 1,
            "type": "string"
          },
          "user_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "user_id",
          "reason"
        ],
        "type": "object"
      },
      "StatusComponent": {
        "additionalProperties": false,
        "properties": {
          "days": {
            "items": {
              "$ref": "#/components/schemas/StatusDay"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "key": {
            "type": "string"
          },
          "since": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "operational",
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "uptime": {
            "format": "double",
            "type": [
              "number",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "state",
          "since",
          "days",
          "uptime"
        ],
        "type": "object"
      },
      "StatusDay": {
        "additionalProperties": false,
        "properties": {
          "day": {
            "type": "string"
          },
          "state": {
            "enum": [
              "none",
              "operational",
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "uptime": {
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "day",
          "state",
          "uptime"
        ],
        "type": "object"
      },
      "StatusDoc": {
        "additionalProperties": false,
        "properties": {
          "components": {
            "items": {
              "$ref": "#/components/schemas/StatusComponent"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "generated_at": {
            "format": "date-time",
            "type": "string"
          },
          "incidents": {
            "items": {
              "$ref": "#/components/schemas/StatusIncident"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "overall": {
            "enum": [
              "operational",
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "version",
          "generated_at",
          "overall",
          "components",
          "incidents"
        ],
        "type": "object"
      },
      "StatusIncident": {
        "additionalProperties": false,
        "properties": {
          "automatic": {
            "type": "boolean"
          },
          "component": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "impact": {
            "enum": [
              "degraded",
              "outage"
            ],
            "type": "string"
          },
          "resolved_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "started_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "investigating",
              "identified",
              "monitoring",
              "resolved"
            ],
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "updates": {
            "items": {
              "$ref": "#/components/schemas/StatusIncidentNote"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "title",
          "state",
          "impact",
          "automatic",
          "started_at",
          "resolved_at",
          "updates"
        ],
        "type": "object"
      },
      "StatusIncidentNote": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "body": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "state",
          "body",
          "at"
        ],
        "type": "object"
      },
      "StepUpInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "Or a code of the authenticator app.",
            "maxLength": 64,
            "type": "string"
          },
          "password": {
            "description": "The current password.",
            "maxLength": 256,
            "type": "string"
          }
        },
        "type": "object"
      },
      "StepUpOutputBody": {
        "additionalProperties": false,
        "properties": {
          "reauth_until": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "reauth_until"
        ],
        "type": "object"
      },
      "StopContainerStruct": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "Account of the server.",
            "format": "uuid",
            "type": "string"
          },
          "service": {
            "description": "Service name of the account.",
            "type": "string"
          }
        },
        "required": [
          "account_id",
          "service"
        ],
        "type": "object"
      },
      "StorageInitInputBody": {
        "additionalProperties": false,
        "properties": {
          "allow_reboot": {
            "description": "Authorize the reboot a remedy needs (XFS root: rootflags=prjquota).",
            "type": "boolean"
          },
          "backing": {
            "description": "Omitted: keep the current backing (host_fs on first init).",
            "enum": [
              "host_fs",
              "loop_pool"
            ],
            "type": "string"
          },
          "pool_size_bytes": {
            "description": "loop_pool only: 0 = half the free space, else 1 GiB to 256 TiB.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "StoragePurgeInputBody": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "description": "Only this (quarantined) account.",
            "format": "uuid",
            "type": "string"
          },
          "older_than_seconds": {
            "description": "Minimum quarantine age to delete (0 = all). Policy default: 1209600 (14 days).",
            "format": "int64",
            "maximum": 315360000,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "older_than_seconds"
        ],
        "type": "object"
      },
      "StorageStatusView": {
        "additionalProperties": false,
        "properties": {
          "backing": {
            "enum": [
              "unspecified",
              "host_fs",
              "loop_pool"
            ],
            "type": "string"
          },
          "detail": {
            "type": "string"
          },
          "fs_type": {
            "examples": [
              "xfs"
            ],
            "type": "string"
          },
          "mount_point": {
            "type": "string"
          },
          "quota_accounting": {
            "type": "boolean"
          },
          "quota_enforcement": {
            "type": "boolean"
          },
          "remedy": {
            "description": "Machine-readable remedy when not ready, e.g. ext4_offline_tune2fs, xfs_root_karg_reboot.",
            "type": "string"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "unspecified",
              "ready",
              "needs_reboot",
              "needs_action"
            ],
            "type": "string"
          }
        },
        "required": [
          "state",
          "fs_type",
          "backing",
          "quota_accounting",
          "quota_enforcement",
          "remedy",
          "detail",
          "mount_point",
          "reported_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "TOTPEnrollOutputBody": {
        "additionalProperties": false,
        "properties": {
          "secret": {
            "description": "Base32, for manual entry. Shown once.",
            "type": "string"
          },
          "uri": {
            "description": "otpauth:// URI for the QR code.",
            "type": "string"
          }
        },
        "required": [
          "secret",
          "uri"
        ],
        "type": "object"
      },
      "TargetView": {
        "additionalProperties": false,
        "properties": {
          "attempt": {
            "format": "int32",
            "type": "integer"
          },
          "confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "failed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "failure_reason": {
            "description": "gate:\u003cname\u003e: \u003cdetail\u003e (the rollback reason sent to the agent).",
            "type": [
              "string",
              "null"
            ]
          },
          "finished_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "gates": {
            "description": "The last evaluation (updating, observing, rolling back; kept afterwards).",
            "items": {
              "$ref": "#/components/schemas/GateView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "job_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "notified_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "passed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "position": {
            "format": "int32",
            "type": "integer"
          },
          "previous_digest": {
            "type": [
              "string",
              "null"
            ]
          },
          "previous_version": {
            "type": [
              "string",
              "null"
            ]
          },
          "ring": {
            "format": "int32",
            "type": "integer"
          },
          "ring_name": {
            "type": "string"
          },
          "rollback_confirmed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "rollback_job_id": {
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "rollback_started_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "scheduled_for": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "server_id": {
            "format": "uuid",
            "type": "string"
          },
          "server_name": {
            "type": "string"
          },
          "skip_reason": {
            "description": "not_image_based: a Compatibility-mode server (no bootc image) never gets an OS update.",
            "enum": [
              "already_on_release",
              "revoked",
              "offline",
              "channel_changed",
              "unsupported_agent",
              "not_image_based",
              null
            ],
            "type": [
              "string",
              "null"
            ]
          },
          "started_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "description": "superseded: a newer rollout took the server over while this one still watched it.",
            "enum": [
              "pending",
              "scheduled",
              "updating",
              "observing",
              "passed",
              "failed",
              "rolling_back",
              "rolled_back",
              "rollback_failed",
              "skipped",
              "superseded"
            ],
            "type": "string"
          },
          "tenant_id": {
            "format": "uuid",
            "type": "string"
          },
          "verdict": {
            "enum": [
              "pass",
              "pending",
              "fail",
              null
            ],
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "server_id",
          "server_name",
          "tenant_id",
          "ring",
          "ring_name",
          "position",
          "state",
          "skip_reason",
          "attempt",
          "scheduled_for",
          "notified_at",
          "job_id",
          "rollback_job_id",
          "previous_version",
          "previous_digest",
          "started_at",
          "confirmed_at",
          "passed_at",
          "failed_at",
          "rollback_started_at",
          "rollback_confirmed_at",
          "finished_at",
          "failure_reason",
          "gates",
          "verdict"
        ],
        "type": "object"
      },
      "TelemetryTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "fill_host_disk_bytes": {
            "description": "Allocate this many bytes on the storage filesystem (1 B..1 TiB).",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "kill_agent": {
            "description": "The agent SIGKILLs itself a few seconds after acknowledging (exit-watch drill).",
            "type": "boolean"
          },
          "release_host_disk": {
            "description": "Remove the fill (allowed on any server).",
            "type": "boolean"
          },
          "stop_container": {
            "$ref": "#/components/schemas/StopContainerStruct",
            "description": "Stop one service's container without changing its desired state (container_down drill); its restart brings it back."
          }
        },
        "type": "object"
      },
      "TenantStruct": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "slug",
          "name"
        ],
        "type": "object"
      },
      "TenantView": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug"
        ],
        "type": "object"
      },
      "TerminalContainersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "TerminalSessionView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "type": "string"
          },
          "bytes_in": {
            "format": "int64",
            "type": "integer"
          },
          "bytes_out": {
            "format": "int64",
            "type": "integer"
          },
          "close_reason": {
            "type": "string"
          },
          "closed_at": {
            "format": "date-time",
            "type": "string"
          },
          "container": {
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "job_id": {
            "type": "string"
          },
          "opened_at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "pending",
              "open",
              "closed"
            ],
            "type": "string"
          },
          "user_id": {
            "type": "string"
          },
          "ws_path": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "account_id",
          "user_id",
          "container",
          "state",
          "bytes_in",
          "bytes_out",
          "created_at"
        ],
        "type": "object"
      },
      "TerminalSessionsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TerminalSessionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "TerminalTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "idle_timeout_seconds": {
            "description": "0 clears the hook (the default 15 minutes)",
            "format": "int32",
            "maximum": 3600,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "idle_timeout_seconds"
        ],
        "type": "object"
      },
      "TokenPasswordInputBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "maxLength": 256,
            "minLength": 1,
            "type": "string"
          },
          "token": {
            "maxLength": 200,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "token",
          "password"
        ],
        "type": "object"
      },
      "UpdateAPIKeyInputBody": {
        "additionalProperties": false,
        "properties": {
          "ip_allowlist": {
            "description": "Replaces the allowlist; [] removes it.",
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "type": [
              "array",
              "null"
            ]
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "rate_limit_per_minute": {
            "description": "0 removes the key's own limit (the edition's applies).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 0,
            "type": "integer"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "UpdateAccountInputBody": {
        "additionalProperties": false,
        "properties": {
          "clear_overrides": {
            "description": "Override fields to remove (accounts.override).",
            "items": {
              "type": "string"
            },
            "maxItems": 12,
            "type": [
              "array",
              "null"
            ]
          },
          "cpu_millicores": {
            "description": "Deprecated raw limit: stored as an override (accounts.override).",
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "inode_limit": {
            "description": "Deprecated raw limit: stored as an override (accounts.override).",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "memory_bytes": {
            "description": "Deprecated raw limit: stored as an override (accounts.override).",
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "overrides": {
            "$ref": "#/components/schemas/OverridesBody",
            "description": "Overrides to set (merged with the existing ones; accounts.override)."
          },
          "plan_id": {
            "description": "New plan (accounts.manage). The same plan again re-converges the live limits.",
            "format": "uuid",
            "type": "string"
          },
          "quota_bytes": {
            "description": "Deprecated raw limit: stored as an override (accounts.override).",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "UpdateChannelInputBody": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "description": "Required unless follow_default.",
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "follow_default": {
            "description": "Follow the organization's default channel (channel ignored).",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "UpdateChannelOutputBody": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "description": "The channel the server will be on once the job succeeds.",
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "job_id": {
            "description": "The set_update_channel job; null when only follow_default changed.",
            "format": "uuid",
            "type": [
              "string",
              "null"
            ]
          },
          "server": {
            "$ref": "#/components/schemas/ServerView"
          }
        },
        "required": [
          "server",
          "channel",
          "job_id"
        ],
        "type": "object"
      },
      "UpdateDBEngineVersionInputBody": {
        "additionalProperties": false,
        "properties": {
          "is_default": {
            "description": "Make it the engine's default (it must be supported).",
            "type": "boolean"
          },
          "status": {
            "enum": [
              "supported",
              "deprecated",
              "disabled"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateMailAliasInputBody": {
        "additionalProperties": false,
        "properties": {
          "targets": {
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "targets"
        ],
        "type": "object"
      },
      "UpdateMailDomainInputBody": {
        "additionalProperties": false,
        "properties": {
          "dmarc_policy": {
            "enum": [
              "none",
              "quarantine",
              "reject",
              ""
            ],
            "type": "string"
          },
          "enabled": {
            "description": "false: mail is refused, mailboxes are kept.",
            "type": "boolean"
          },
          "mta_sts_mode": {
            "enum": [
              "none",
              "testing",
              "enforce",
              ""
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateMailboxInputBody": {
        "additionalProperties": false,
        "properties": {
          "display_name": {
            "maxLength": 128,
            "type": "string"
          },
          "login_enabled": {
            "type": "boolean"
          },
          "quota_bytes": {
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "send_limit_per_hour": {
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "UpdatePlanInputBody": {
        "additionalProperties": false,
        "properties": {
          "cpu_millicores": {
            "description": "CPU envelope in millicores (1000 = one CPU).",
            "format": "int32",
            "maximum": 64000,
            "minimum": 100,
            "type": "integer"
          },
          "inode_limit": {
            "description": "Inode limit: 1000 to 100M.",
            "format": "int64",
            "maximum": 100000000,
            "minimum": 1000,
            "type": "integer"
          },
          "mail_send_limit_per_hour": {
            "description": "Default outgoing messages per hour of a new mailbox (default 200).",
            "format": "int32",
            "maximum": 100000,
            "minimum": 1,
            "type": "integer"
          },
          "mailbox_quota_bytes": {
            "description": "Default quota of a new mailbox in bytes (0 = unlimited; default 1 GiB).",
            "format": "int64",
            "maximum": 1099511627776,
            "minimum": 0,
            "type": "integer"
          },
          "max_db_services": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sftp_users": {
            "format": "int32",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "max_sites": {
            "format": "int32",
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "memory_bytes": {
            "description": "Memory envelope: 64 MiB to 256 GiB.",
            "format": "int64",
            "maximum": 274877906944,
            "minimum": 67108864,
            "type": "integer"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "php_versions_allowed": {
            "description": "Allowed PHP versions (X.Y); empty = every supported version.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "quota_bytes": {
            "description": "Disk quota: 64 MiB to 16 TiB.",
            "format": "int64",
            "maximum": 17592186044416,
            "minimum": 67108864,
            "type": "integer"
          },
          "sftp_allowed": {
            "type": "boolean"
          },
          "terminal_enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "quota_bytes",
          "inode_limit",
          "cpu_millicores",
          "memory_bytes",
          "max_sites",
          "max_db_services",
          "max_sftp_users",
          "terminal_enabled",
          "sftp_allowed",
          "php_versions_allowed"
        ],
        "type": "object"
      },
      "UpdateRingInputBody": {
        "additionalProperties": false,
        "properties": {
          "internal": {
            "type": "boolean"
          }
        },
        "required": [
          "internal"
        ],
        "type": "object"
      },
      "UpdateSettingsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "default_channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          },
          "enqueued": {
            "description": "set_update_channel jobs enqueued for following servers (PUT).",
            "format": "int64",
            "type": "integer"
          },
          "unsupported": {
            "description": "Following servers whose agent cannot change channel (PUT; they keep theirs).",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "default_channel"
        ],
        "type": "object"
      },
      "UpdateSettingsView": {
        "additionalProperties": false,
        "properties": {
          "default_channel": {
            "enum": [
              "stable",
              "preview"
            ],
            "type": "string"
          }
        },
        "required": [
          "default_channel"
        ],
        "type": "object"
      },
      "UpdateStatusView": {
        "additionalProperties": false,
        "properties": {
          "agent": {
            "$ref": "#/components/schemas/AgentStatus"
          },
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "channel": {
            "type": "string"
          },
          "convert": {
            "$ref": "#/components/schemas/ConvertStatus"
          },
          "os": {
            "$ref": "#/components/schemas/OSStatus"
          },
          "reported_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "reported_at",
          "channel",
          "capabilities"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "UpdateTestHooksInputBody": {
        "additionalProperties": false,
        "properties": {
          "backdate_days": {
            "description": "Move this server's update confirmations and passes this many days into the past.",
            "format": "int64",
            "maximum": 365,
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "backdate_days"
        ],
        "type": "object"
      },
      "UpdateTestHooksOutputBody": {
        "additionalProperties": false,
        "properties": {
          "targets": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "targets"
        ],
        "type": "object"
      },
      "UpdateUserInputBody": {
        "additionalProperties": false,
        "properties": {
          "role": {
            "enum": [
              "admin",
              "reseller",
              "client"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "active",
              "disabled"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateZoneInputBody": {
        "additionalProperties": false,
        "properties": {
          "status": {
            "enum": [
              "active",
              "shadow"
            ],
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "Usage": {
        "additionalProperties": false,
        "properties": {
          "accounts": {
            "format": "int64",
            "type": "integer"
          },
          "disk_bytes": {
            "format": "int64",
            "type": "integer"
          },
          "sites": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "accounts",
          "disk_bytes",
          "sites"
        ],
        "type": "object"
      },
      "UserDetailView": {
        "additionalProperties": false,
        "properties": {
          "accounts": {
            "description": "Accounts the user is attached to (clients).",
            "items": {
              "$ref": "#/components/schemas/AccountUserView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "display_name": {
            "type": "string"
          },
          "email": {
            "format": "email",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "locale": {
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "reseller_limits": {
            "$ref": "#/components/schemas/ResellerLimitsView",
            "description": "Resellers: limits and current allocations."
          },
          "role": {
            "description": "Highest role (user listings).",
            "enum": [
              "admin",
              "reseller",
              "client"
            ],
            "type": "string"
          },
          "status": {
            "description": "active, disabled, invited (waiting for the invitation to be accepted) or deleted (pseudonymized: e-mail deleted-\u003cid\u003e@invalid, empty display name; ADR-0013 §4).",
            "type": "string"
          }
        },
        "required": [
          "accounts",
          "id",
          "email",
          "display_name",
          "locale",
          "status",
          "created_at"
        ],
        "type": "object"
      },
      "UserGrantsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/GrantView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "UserMFAView": {
        "additionalProperties": false,
        "properties": {
          "mfa_required": {
            "type": "boolean"
          },
          "passkeys": {
            "format": "int64",
            "type": "integer"
          },
          "recovery_codes_remaining": {
            "format": "int64",
            "type": "integer"
          },
          "totp_enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "totp_enabled",
          "passkeys",
          "recovery_codes_remaining",
          "mfa_required"
        ],
        "type": "object"
      },
      "UserStruct": {
        "additionalProperties": false,
        "properties": {
          "display_name": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "email",
          "display_name"
        ],
        "type": "object"
      },
      "UserView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "display_name": {
            "type": "string"
          },
          "email": {
            "format": "email",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "locale": {
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "role": {
            "description": "Highest role (user listings).",
            "enum": [
              "admin",
              "reseller",
              "client"
            ],
            "type": "string"
          },
          "status": {
            "description": "active, disabled, invited (waiting for the invitation to be accepted) or deleted (pseudonymized: e-mail deleted-\u003cid\u003e@invalid, empty display name; ADR-0013 §4).",
            "type": "string"
          }
        },
        "required": [
          "id",
          "email",
          "display_name",
          "locale",
          "status",
          "created_at"
        ],
        "type": "object"
      },
      "VerifyAuditChainInputBody": {
        "additionalProperties": false,
        "properties": {
          "from_seq": {
            "description": "range: first seq (\u003e= 1).",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "kind": {
            "default": "full",
            "enum": [
              "incremental",
              "full",
              "range"
            ],
            "type": "string"
          },
          "to_seq": {
            "description": "range: last seq (0 = the head).",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "VersionBody": {
        "additionalProperties": false,
        "properties": {
          "commit": {
            "examples": [
              "e71d013"
            ],
            "type": "string"
          },
          "version": {
            "examples": [
              "v0.3.0"
            ],
            "type": "string"
          }
        },
        "required": [
          "version",
          "commit"
        ],
        "type": "object"
      },
      "WAFDefaultsBody": {
        "additionalProperties": false,
        "properties": {
          "default_mode": {
            "description": "The WAF mode a new site gets. Existing sites keep theirs.",
            "enum": [
              "off",
              "detect",
              "block"
            ],
            "type": "string"
          }
        },
        "required": [
          "default_mode"
        ],
        "type": "object"
      },
      "WAFEventView": {
        "additionalProperties": false,
        "properties": {
          "account_id": {
            "format": "uuid",
            "type": "string"
          },
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "blocked": {
            "description": "false: logged only (detect mode).",
            "type": "boolean"
          },
          "client_ip": {
            "type": "string"
          },
          "host": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "path": {
            "description": "Without the query string. Request bodies are never recorded.",
            "type": "string"
          },
          "rule_ids": {
            "items": {
              "format": "int32",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "severity": {
            "enum": [
              "",
              "critical",
              "error",
              "warning",
              "notice"
            ],
            "type": "string"
          },
          "site_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "site_id",
          "account_id",
          "at",
          "client_ip",
          "method",
          "host",
          "path",
          "rule_ids",
          "severity",
          "blocked",
          "message"
        ],
        "type": "object"
      },
      "WAFExclusionView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "path_prefix": {
            "description": "Empty: the whole site.",
            "type": "string"
          },
          "rule_id": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "rule_id",
          "path_prefix",
          "created_at"
        ],
        "type": "object"
      },
      "WaitlistEntryView": {
        "additionalProperties": false,
        "properties": {
          "consented_at": {
            "format": "date-time",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "locale": {
            "enum": [
              "ro",
              "en",
              "es"
            ],
            "type": "string"
          },
          "name": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "email",
          "name",
          "locale",
          "consented_at",
          "created_at"
        ],
        "type": "object"
      },
      "WebAuthnOptionsBody": {
        "additionalProperties": false,
        "properties": {
          "publicKey": {
            "description": "PublicKeyCredentialRequestOptions (or CreationOptions) as JSON; binary fields are base64url."
          }
        },
        "required": [
          "publicKey"
        ],
        "type": "object"
      },
      "WebhookAcceptedOutputBody": {
        "additionalProperties": false,
        "properties": {
          "delivery_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "delivery_id"
        ],
        "type": "object"
      },
      "WebhookAttemptView": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "attempt": {
            "format": "int64",
            "type": "integer"
          },
          "duration_ms": {
            "format": "int64",
            "type": "integer"
          },
          "error": {
            "type": [
              "string",
              "null"
            ]
          },
          "status_code": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "attempt",
          "status_code",
          "error",
          "duration_ms",
          "at"
        ],
        "type": "object"
      },
      "WebhookDeliveryDetail": {
        "additionalProperties": false,
        "properties": {
          "attempt_log": {
            "items": {
              "$ref": "#/components/schemas/WebhookAttemptView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "attempts": {
            "format": "int64",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "event_id": {
            "description": "The event's public id (the payload's id; the same for every delivery of the event).",
            "format": "uuid",
            "type": "string"
          },
          "event_type": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_duration_ms": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "last_error": {
            "description": "Error class of the last attempt (http_status, timeout, dns, tls, address_not_public, connection, …).",
            "type": [
              "string",
              "null"
            ]
          },
          "last_status_code": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "manual": {
            "description": "A ping or a re-send.",
            "type": "boolean"
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "payload": {
            "description": "The exact JSON body that is (or was) sent."
          },
          "state": {
            "description": "pending: not attempted yet; failed: the last attempt failed, next_attempt_at is the retry; dead: 7 attempts failed.",
            "enum": [
              "pending",
              "succeeded",
              "failed",
              "dead"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "webhook_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "attempt_log",
          "payload",
          "id",
          "webhook_id",
          "event_id",
          "event_type",
          "state",
          "attempts",
          "manual",
          "last_status_code",
          "last_error",
          "last_duration_ms",
          "next_attempt_at",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "WebhookDeliveryView": {
        "additionalProperties": false,
        "properties": {
          "attempts": {
            "format": "int64",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "event_id": {
            "description": "The event's public id (the payload's id; the same for every delivery of the event).",
            "format": "uuid",
            "type": "string"
          },
          "event_type": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_duration_ms": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "last_error": {
            "description": "Error class of the last attempt (http_status, timeout, dns, tls, address_not_public, connection, …).",
            "type": [
              "string",
              "null"
            ]
          },
          "last_status_code": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "manual": {
            "description": "A ping or a re-send.",
            "type": "boolean"
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "description": "pending: not attempted yet; failed: the last attempt failed, next_attempt_at is the retry; dead: 7 attempts failed.",
            "enum": [
              "pending",
              "succeeded",
              "failed",
              "dead"
            ],
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "webhook_id": {
            "format": "uuid",
            "type": "string"
          }
        },
        "required": [
          "id",
          "webhook_id",
          "event_id",
          "event_type",
          "state",
          "attempts",
          "manual",
          "last_status_code",
          "last_error",
          "last_duration_ms",
          "next_attempt_at",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      },
      "WebhookEventTypeView": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "reserved": {
            "description": "Documented but not sent yet.",
            "type": "boolean"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type",
          "description",
          "reserved"
        ],
        "type": "object"
      },
      "WebhookEventTypesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WebhookEventTypeView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "WebhookLastDelivery": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "state": {
            "enum": [
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "status_code": {
            "description": "HTTP status of the answer; null when none came (timeout, connection, TLS).",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "state",
          "status_code",
          "at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "WebhookSecretOutputBody": {
        "additionalProperties": false,
        "properties": {
          "secret": {
            "description": "The signing secret (whsec_…), shown only now: PlusPanel-Signature is t=\u003cunix\u003e,v1=\u003chex HMAC-SHA256(secret, \"\u003ct\u003e.\u003cbody\u003e\")\u003e.",
            "type": "string"
          },
          "webhook": {
            "$ref": "#/components/schemas/WebhookView"
          }
        },
        "required": [
          "webhook",
          "secret"
        ],
        "type": "object"
      },
      "WebhookView": {
        "additionalProperties": false,
        "properties": {
          "consecutive_failures": {
            "description": "Failed attempts since the last successful one.",
            "format": "int64",
            "type": "integer"
          },
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "events": {
            "description": "Event patterns: *, \u003cresource\u003e.* or an event type.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "last_delivery": {
            "$ref": "#/components/schemas/WebhookLastDelivery",
            "description": "Outcome of the most recent attempt; null before the first one."
          },
          "previous_secret_valid_until": {
            "description": "During a secret rotation's grace, deliveries carry a second v1 signature with the previous secret until then.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "url",
          "description",
          "events",
          "enabled",
          "previous_secret_valid_until",
          "created_at",
          "updated_at",
          "last_delivery",
          "consecutive_failures"
        ],
        "type": "object"
      },
      "WindowBody": {
        "additionalProperties": false,
        "properties": {
          "duration_minutes": {
            "format": "int64",
            "maximum": 1440,
            "minimum": 15,
            "type": "integer"
          },
          "start_minute": {
            "format": "int64",
            "maximum": 1439,
            "minimum": 0,
            "type": "integer"
          },
          "timezone": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "weekdays": {
            "description": "Bitmask Mon=1 .. Sun=64.",
            "format": "int64",
            "maximum": 127,
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "weekdays",
          "start_minute",
          "duration_minutes",
          "timezone"
        ],
        "type": "object"
      },
      "WindowOutputBody": {
        "additionalProperties": false,
        "properties": {
          "next_opening": {
            "description": "The next instant inside the window (now when open); null without a window.",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "window": {
            "$ref": "#/components/schemas/WindowView",
            "description": "Null: none (updates may run any time)."
          }
        },
        "required": [
          "window",
          "next_opening"
        ],
        "type": "object"
      },
      "WindowView": {
        "additionalProperties": false,
        "properties": {
          "duration_minutes": {
            "format": "int32",
            "type": "integer"
          },
          "start_minute": {
            "description": "Local start, minutes after midnight (0..1439).",
            "format": "int32",
            "type": "integer"
          },
          "timezone": {
            "description": "IANA time zone, e.g. Europe/Bucharest.",
            "type": "string"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          },
          "weekdays": {
            "description": "Bitmask Mon=1, Tue=2, Wed=4, Thu=8, Fri=16, Sat=32, Sun=64.",
            "format": "int32",
            "type": "integer"
          }
        },
        "required": [
          "weekdays",
          "start_minute",
          "duration_minutes",
          "timezone",
          "updated_at"
        ],
        "type": [
          "object",
          "null"
        ]
      },
      "WpCliInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "description": "USER_CREATE.",
            "type": "string"
          },
          "key": {
            "description": "OPTION_GET / OPTION_SET: blogname, blogdescription, siteurl, home, admin_email, timezone_string, date_format, time_format, start_of_week, permalink_structure, blog_public, default_role, users_can_register, WPLANG, posts_per_page, default_comment_status.",
            "type": "string"
          },
          "label": {
            "description": "DB_EXPORT / DB_IMPORT: [a-z0-9][a-z0-9-]{0,40}.",
            "type": "string"
          },
          "login": {
            "description": "USER_CREATE / USER_PASSWORD_RESET: [A-Za-z0-9._-]{3,32}.",
            "type": "string"
          },
          "operation": {
            "description": "One of CORE_VERSION, CORE_UPDATE, OPTION_GET, OPTION_SET, PLUGIN_INSTALL, PLUGIN_ACTIVATE, PLUGIN_DEACTIVATE, PLUGIN_UPDATE, PLUGIN_LIST, THEME_INSTALL, THEME_ACTIVATE, THEME_UPDATE, THEME_LIST, USER_CREATE, USER_PASSWORD_RESET, SEARCH_REPLACE, SEARCH_REPLACE_DRY_RUN, DB_EXPORT, DB_IMPORT, MAINTENANCE_ACTIVATE, MAINTENANCE_DEACTIVATE, MAINTENANCE_STATUS, CACHE_FLUSH, LSCACHE_PURGE_ALL. Anything else is refused (422 wp_operation_not_allowed) and audited.",
            "type": "string"
          },
          "replace": {
            "description": "SEARCH_REPLACE*: at most 256 bytes, not starting with '-'.",
            "type": "string"
          },
          "role": {
            "description": "USER_CREATE: subscriber, contributor, author, editor or administrator.",
            "type": "string"
          },
          "search": {
            "description": "SEARCH_REPLACE*: at most 256 bytes, not starting with '-'.",
            "type": "string"
          },
          "skip_snapshot": {
            "description": "CORE_UPDATE / PLUGIN_UPDATE / THEME_UPDATE: by default (backups configured, agent with the backup engine) the site is first snapshotted by the backup engine and the update runs only once the snapshot is committed (the job returned is then the backup run; POST /sites/{id}/backup-rollback undoes the update). true skips that.",
            "type": "boolean"
          },
          "slug": {
            "description": "Plugin or theme slug (wordpress.org), [a-z0-9][a-z0-9-]{0,63}.",
            "type": "string"
          },
          "value": {
            "description": "OPTION_SET: printable UTF-8, at most 1024 bytes.",
            "type": "string"
          },
          "version": {
            "description": "Optional version pin (install, update, CORE_UPDATE).",
            "type": "string"
          }
        },
        "required": [
          "operation"
        ],
        "type": "object"
      },
      "ZoneDNSSECView": {
        "additionalProperties": false,
        "properties": {
          "dnskey": {
            "description": "Public DNSKEY of the shared CSK (flags protocol algorithm key).",
            "type": "string"
          },
          "ds": {
            "description": "DS records for the parent (key tag, algorithm, digest type, digest); SHA-256 first.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ds_published": {
            "description": "The operator confirmed the DS at the parent; DNSSEC cannot be switched off meanwhile.",
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "key_tag": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "parent_records": {
            "description": "The DS as presentation records to paste at the parent.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "published_key_tag": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "state": {
            "description": "'' (off), pending (the key is not on every nameserver yet), ok, ds_mismatch (the key changed after the DS was published: replace the DS at the parent), error.",
            "enum": [
              "",
              "pending",
              "ok",
              "ds_mismatch",
              "error"
            ],
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "state",
          "key_tag",
          "dnskey",
          "ds",
          "parent_records",
          "ds_published",
          "published_key_tag"
        ],
        "type": "object"
      },
      "ZoneListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ZoneView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ZoneSyncView": {
        "additionalProperties": false,
        "properties": {
          "nameservers": {
            "items": {
              "$ref": "#/components/schemas/NameserverSyncView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "state": {
            "description": "synced: every nameserver serves the current serial; degraded: at least one does, not all; pending: none yet; unconfigured: no nameserver configured.",
            "enum": [
              "synced",
              "degraded",
              "pending",
              "unconfigured"
            ],
            "type": "string"
          }
        },
        "required": [
          "state",
          "nameservers"
        ],
        "type": "object"
      },
      "ZoneTemplateInput": {
        "additionalProperties": false,
        "properties": {
          "apex_ipv4": {
            "description": "A record at the apex.",
            "type": "string"
          },
          "apex_ipv6": {
            "description": "AAAA record at the apex.",
            "type": "string"
          },
          "mx_host": {
            "description": "MX 10 at the apex.",
            "type": "string"
          },
          "server_id": {
            "description": "Take the apex addresses from this server (PATCH /servers/{id}/addresses) instead.",
            "format": "uuid",
            "type": "string"
          },
          "spf": {
            "description": "SPF placeholder \"v=spf1 -all\" (no host sends mail until mail is set up).",
            "type": "boolean"
          },
          "www": {
            "description": "www CNAME to the apex (needs an apex address).",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "ZoneView": {
        "additionalProperties": false,
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "dnssec": {
            "$ref": "#/components/schemas/ZoneDNSSECView"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "examples": [
              "example.com"
            ],
            "type": "string"
          },
          "nameservers": {
            "description": "The apex NS records (what to set at the registrar).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "records": {
            "description": "Number of records (the platform's SOA and apex NS excluded).",
            "format": "int64",
            "type": "integer"
          },
          "serial": {
            "description": "SOA serial; every change bumps it.",
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "description": "active: served (delegate the domain to the nameservers); shadow: served but not delegated yet (an import awaiting cutover); removing: being deleted from the nameservers.",
            "enum": [
              "active",
              "shadow",
              "removing"
            ],
            "type": "string"
          },
          "sync": {
            "$ref": "#/components/schemas/ZoneSyncView"
          },
          "updated_at": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "serial",
          "nameservers",
          "dnssec",
          "sync",
          "records",
          "created_at",
          "updated_at"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "apiKey": {
        "bearerFormat": "ppk",
        "description": "API key (`Authorization: Bearer ppk_…`, ADR-0016 §2): created in Settings → API, with POST /api-keys or by `pluspanel login` (device flow). A request with an Authorization header ignores cookies and needs no CSRF token. A key may do what its user may do AND what its scopes cover; responses carry RateLimit-* headers.",
        "scheme": "bearer",
        "type": "http"
      },
      "session": {
        "description": "Session cookie set by POST /auth/login.",
        "in": "cookie",
        "name": "pp_session",
        "type": "apiKey"
      }
    }
  },
  "info": {
    "description": "Public REST API of the PlusPanel control plane (conventions: ADR-0016). Errors are RFC 9457 `application/problem+json` documents (`type`, `title`, `status`, `detail`, `instance`, `code`, `request_id`) that also carry the legacy envelope `{\"error\":{\"code\",\"message\",\"request_id\"}}`. Mutating POSTs accept `Idempotency-Key`; JSON GETs answer a strong `ETag` and honour `If-None-Match`; PUT and PATCH operations marked `x-pluspanel-etag` honour `If-Match` (optimistic concurrency, not a lock). Unsafe methods on an authenticated session require the `X-CSRF-Token` header (value of the `pp_csrf` cookie).",
    "title": "PlusPanel API",
    "version": "1.0.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/accounts": {
      "get": {
        "description": "Requires `accounts.read`: admins see every account of the organization, resellers the accounts they own, clients the accounts they are attached to (ADR-0009). Purged accounts are omitted.",
        "operationId": "listTenantAccounts",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAccountSummaryView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the accounts the caller reaches, on every server",
        "tags": [
          "accounts"
        ]
      }
    },
    "/accounts/{account_id}/sites": {
      "get": {
        "operationId": "listAccountSites",
        "parameters": [
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the WordPress sites of an account (admin)",
        "tags": [
          "sites"
        ]
      },
      "post": {
        "description": "Creates the site (`installing`), resolves the digests of the PHP version's php-ols image, `mariadb`, `wp-tools` and `ingress` (`stable`) from the platform registry and enqueues `deploy_wordpress_site`. The account must be active with a ready runtime (409 otherwise) and every host name unused on the server (409 `domain_taken`). When the ingress image cannot be resolved the site is deployed unrouted (set its domains later). When the job succeeds the site is `active`; the generated administrator password is returned once by `GET /jobs/{job_id}/sensitive` and stored nowhere. A failed deploy leaves the site `broken` with the agent's error code in `detail`. Errors: 422 validation, 503 `catalog_unavailable`. Requires `X-CSRF-Token`.",
        "operationId": "launchSite",
        "parameters": [
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LaunchSiteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Launch a WordPress site (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/accounts/{id}": {
      "get": {
        "operationId": "getTenantAccount",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get an account the caller reaches, with plan, effective limits and usage",
        "tags": [
          "accounts"
        ]
      }
    },
    "/accounts/{id}/backup-retention": {
      "delete": {
        "description": "`backups.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "clearAccountBackupRetention",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountBackupsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Return an account to the organization's retention",
        "tags": [
          "backups"
        ]
      },
      "put": {
        "description": "`backups.manage`; edition feature `backup_retention`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setAccountBackupRetention",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RetentionView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountBackupsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Give an account its own retention (Pro and above)",
        "tags": [
          "backups"
        ]
      }
    },
    "/accounts/{id}/backups": {
      "get": {
        "description": "`backups.read` at the caller's scope (clients: their accounts; resellers: theirs). A deleted account's snapshots stay listed during the hold.",
        "operationId": "listAccountBackups",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountBackupsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "An account's snapshots, restores and downloads",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "`backups.run`. Enqueues `backup_run` (reason manual) for this account on its server's repository. 503 `backups_unavailable` when no destination is configured. Audited. Requires `X-CSRF-Token`.",
        "operationId": "runAccountBackup",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Back an account up now",
        "tags": [
          "backups"
        ]
      }
    },
    "/accounts/{id}/backups/browse": {
      "post": {
        "description": "`backups.read`. Enqueues `browse_snapshot`; the listing is the job's output (GET /jobs/{id}): entries with name, type, size, mode, mtime, and a next offset. Requires `X-CSRF-Token`.",
        "operationId": "browseAccountBackup",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BrowseBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a directory of a snapshot",
        "tags": [
          "backups"
        ]
      }
    },
    "/accounts/{id}/db-services": {
      "get": {
        "operationId": "listDBServices",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Also list removed services (their data is in the account's quarantine).",
            "explode": false,
            "in": "query",
            "name": "include_removed",
            "schema": {
              "description": "Also list removed services (their data is in the account's quarantine).",
              "type": "boolean"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List an account's database services (admin)",
        "tags": [
          "databases"
        ]
      },
      "post": {
        "description": "Resolves the version's image digest and enqueues `provision_db_service`: an unpublished container on the account network, data in the account's volume. 409 when the account's storage or runtime is not ready, `db_name_taken` for a name in use; 422 for an unknown or disabled version. Audited. Requires `X-CSRF-Token`.",
        "operationId": "createDBService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateDBServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a database service (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/accounts/{id}/exports": {
      "post": {
        "description": "`backups.restore`. Enqueues `export_snapshot`: the agent writes a tar.gz to the destination; GET /backup-exports/{id} then gives a 1-hour link. Deleted after 24 hours. Audited. Requires `X-CSRF-Token`.",
        "operationId": "createAccountExport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateExportInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupExportView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Build a download archive (tar.gz) of a snapshot",
        "tags": [
          "backups"
        ]
      }
    },
    "/accounts/{id}/files": {
      "post": {
        "description": "Enqueues one typed file operation (agent ADR-0008 §1): list, stat, read, write, delete, move, copy, mkdir, chmod, archive, unarchive, on the virtual tree `/web/\u003csite-key\u003e/...` (read-write) and `/dumps/\u003cservice-key\u003e/...` (read-only). The agent runs it as the account user. Poll `GET /jobs/{id}`; a read's content is in `GET /jobs/{id}/sensitive` (once, never stored). Writes are at most 2 MiB (larger: SFTP). Mutations and refusals are audited. Requires `X-CSRF-Token`.",
        "operationId": "fileOperation",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FileOperationInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobAcceptedBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Run a file operation as the account user (admin)",
        "tags": [
          "files"
        ]
      }
    },
    "/accounts/{id}/mail/domains": {
      "get": {
        "operationId": "listMailDomains",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "An account's mail domains",
        "tags": [
          "mail"
        ]
      },
      "post": {
        "description": "The domain's DNS is managed when a zone of the organization covers it (records written as a set, `managed_by: mail`), else external (`GET /mail/domains/{id}/dns` lists the records to publish). The first domain of a server whose mail is off enables it first (`set_mail_server`, then `set_mail_domain`). 409 `mail_domain_taken`, `mail_server_not_configured` (no mail host name yet). Audited.",
        "operationId": "createMailDomain",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateMailDomainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Add a mail domain to an account",
        "tags": [
          "mail"
        ]
      }
    },
    "/accounts/{id}/observability": {
      "get": {
        "description": "Account and site panels (account_*, containers, requests, errors) of the account; 422 `panel_not_available` for node panels. `observability.read` (resellers and clients: their accounts). Source `central` when the organization's central stores hold the panel within its retention, otherwise `local` (a signed query to the server's agent: 409 `telemetry_unsupported_agent`, 503 `agent_offline`, 504 `telemetry_query_timeout`).",
        "operationId": "getAccountObservability",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Panel of the closed set (ADR-0014 §9).",
            "explode": false,
            "in": "query",
            "name": "panel",
            "required": true,
            "schema": {
              "description": "Panel of the closed set (ADR-0014 §9).",
              "enum": [
                "cpu",
                "memory",
                "load",
                "disk",
                "inodes",
                "disk_io",
                "network",
                "requests",
                "errors",
                "account_cpu",
                "account_memory",
                "account_storage",
                "account_io",
                "account_network",
                "containers"
              ],
              "type": "string"
            }
          },
          {
            "description": "Range start (RFC 3339); default one hour before to.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Range start (RFC 3339); default one hour before to.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Range end (RFC 3339); default now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Range end (RFC 3339); default now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
            "explode": false,
            "in": "query",
            "name": "step",
            "schema": {
              "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
              "format": "int64",
              "maximum": 86400,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "An account panel",
        "tags": [
          "observability"
        ]
      }
    },
    "/accounts/{id}/restores": {
      "post": {
        "description": "`backups.restore`. Whole account, one site, one database service or database, or selected paths; in place (behind an automatic `before_restore` snapshot of what is replaced) or alternate (files to /restores/\u003cid\u003e/, databases into a new service). A deleted account (status quarantined) comes back with its id, on its server or `target_server_id` (another server of the organization; `backups.manage`): its quarantine is purged, it is provisioned again and only then restored (state preparing). Every restore is audited. Requires `X-CSRF-Token`.",
        "operationId": "createAccountRestore",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateRestoreInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupRestoreView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Restore from a snapshot",
        "tags": [
          "backups"
        ]
      }
    },
    "/accounts/{id}/server-updates": {
      "get": {
        "description": "Scheduled and running updates (the banner) and the update history of the server that hosts the account. No control.",
        "operationId": "getAccountServerUpdates",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountServerUpdatesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Maintenance of the account's server (client)",
        "tags": [
          "updates"
        ]
      }
    },
    "/accounts/{id}/sftp-user": {
      "delete": {
        "operationId": "removeSftpUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpUserJobOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the account's SFTP user (admin)",
        "tags": [
          "sftp"
        ]
      },
      "get": {
        "operationId": "getSftpUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpUserView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The account's SFTP user (admin)",
        "tags": [
          "sftp"
        ]
      },
      "post": {
        "description": "The only way an account gets an SFTP user. Login `sftp-\u003caccount name\u003e`; the generated password is shown once through `GET /jobs/{id}/sensitive`. Audited. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createSftpUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpUserJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create the account's SFTP user (admin, explicit only)",
        "tags": [
          "sftp"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/accounts/{id}/sftp-user/keys": {
      "put": {
        "description": "OpenSSH public key lines: ed25519, ecdsa, security keys, RSA of at least 3072 bits; no options; at most 20. Audited.",
        "operationId": "setSftpKeys",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetSftpKeysInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpUserJobOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace the SFTP user's public keys (admin)",
        "tags": [
          "sftp"
        ]
      }
    },
    "/accounts/{id}/sftp-user/password": {
      "post": {
        "description": "Shown once through `GET /jobs/{id}/sensitive`. Audited. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "resetSftpPassword",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpUserJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Generate a new SFTP password (admin)",
        "tags": [
          "sftp"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/accounts/{id}/terminal-containers": {
      "get": {
        "operationId": "listTerminalContainers",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalContainersOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Containers a web terminal can open into (admin)",
        "tags": [
          "terminal"
        ]
      }
    },
    "/accounts/{id}/terminal-sessions": {
      "get": {
        "operationId": "listTerminalSessions",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalSessionsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The account's web terminal sessions (admin)",
        "tags": [
          "terminal"
        ]
      },
      "post": {
        "description": "Starts an interactive shell in a web or service container of the account (agent ADR-0008 §3) and returns the session; the browser then opens the websocket `GET /api/v1/terminal-sessions/{id}/ws` (same session cookie, same user, same origin) within 60 s. At most 2 live sessions per account (409 `terminal_limit`); 15 minutes without input ends a session. Only metadata is recorded (who, where, when, duration, byte counts), never keystrokes or output. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "openTerminalSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OpenTerminalInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalSessionView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Open a web terminal (admin)",
        "tags": [
          "terminal"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/accounts/{id}/users": {
      "get": {
        "operationId": "listAccountUsers",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountUsersOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Client users attached to an account",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "description": "Requires `users.invite` on the account. Only client users. Audited `account.user_add`.",
        "operationId": "addAccountUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AddAccountUserInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountUserView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Attach a client user to an account",
        "tags": [
          "accounts"
        ]
      }
    },
    "/accounts/{id}/users/{user_id}": {
      "delete": {
        "description": "Requires `users.invite` on the account. Audited `account.user_remove`.",
        "operationId": "removeAccountUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Detach a user from an account",
        "tags": [
          "accounts"
        ]
      }
    },
    "/accounts/{id}/waf": {
      "put": {
        "description": "The account-wide switch: every site of the account gets the mode (other policy fields stay). Sites on an agent without a security engine are stored and pushed once it reports one. `security.waf`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setAccountWAF",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetAccountWAFInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SetAccountWAFOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the WAF mode of every site of an account",
        "tags": [
          "security"
        ]
      }
    },
    "/accounts/{id}/waf-events": {
      "get": {
        "description": "`security.waf_log`.",
        "operationId": "listAccountWAFEvents",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Only this site of the account.",
            "explode": false,
            "in": "query",
            "name": "site_id",
            "schema": {
              "description": "Only this site of the account.",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Only blocked or only detected (logged) requests.",
            "explode": false,
            "in": "query",
            "name": "outcome",
            "schema": {
              "description": "Only blocked or only detected (logged) requests.",
              "enum": [
                "blocked",
                "detected"
              ],
              "type": "string"
            }
          },
          {
            "description": "Events at or after this time.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Events at or after this time.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Events before this time.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Events before this time.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWAFEventView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the WAF events of an account's sites (newest first, 30 days)",
        "tags": [
          "security"
        ]
      }
    },
    "/alert-rules": {
      "get": {
        "description": "Requires `alerts.manage`. Operator-only kinds (platform probes, audit chain) are listed for the operator organization only.",
        "operationId": "listAlertRules",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertRulesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Alert rule kinds with the organization's settings",
        "tags": [
          "alerts"
        ]
      }
    },
    "/alert-rules/{kind}": {
      "get": {
        "description": "Requires `alerts.manage`.",
        "operationId": "getAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "kind",
            "required": true,
            "schema": {
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertRuleView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "One alert rule",
        "tags": [
          "alerts"
        ]
      },
      "put": {
        "description": "Requires `alerts.manage`. Unknown parameters or values outside their bounds: 422. Disabling a rule resolves its open alerts at the next evaluation. Audited `alert.rule_updated`.",
        "operationId": "putAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "kind",
            "required": true,
            "schema": {
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutAlertRuleInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertRuleView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Switch a rule on or off and tune its parameters",
        "tags": [
          "alerts"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/alert-silences": {
      "get": {
        "description": "Requires `alerts.manage`.",
        "operationId": "listAlertSilences",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SilencesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Current and future silences",
        "tags": [
          "alerts"
        ]
      },
      "post": {
        "description": "Requires `alerts.manage`. Matchers: rule, server, account (at least one); the window ends after it starts and lasts at most 90 days. Silenced alerts still fire and are recorded; they notify nobody. Audited `alert.silence_created`.",
        "operationId": "createAlertSilence",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateSilenceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SilenceView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Silence notifications of matching alerts for a window",
        "tags": [
          "alerts"
        ]
      }
    },
    "/alert-silences/{id}": {
      "delete": {
        "description": "Requires `alerts.manage`. Audited `alert.silence_deleted`.",
        "operationId": "deleteAlertSilence",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a silence",
        "tags": [
          "alerts"
        ]
      }
    },
    "/alerts": {
      "get": {
        "description": "Requires `alerts.read`. Admins see the organization's alerts; resellers and clients only those of the accounts they reach. Newest first.",
        "operationId": "listAlerts",
        "parameters": [
          {
            "description": "open = pending or firing.",
            "explode": false,
            "in": "query",
            "name": "state",
            "schema": {
              "description": "open = pending or firing.",
              "enum": [
                "open",
                "pending",
                "firing",
                "resolved"
              ],
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "rule",
            "schema": {
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "description": "UUID",
            "explode": false,
            "in": "query",
            "name": "server_id",
            "schema": {
              "description": "UUID",
              "type": "string"
            }
          },
          {
            "description": "UUID",
            "explode": false,
            "in": "query",
            "name": "account_id",
            "schema": {
              "description": "UUID",
              "type": "string"
            }
          },
          {
            "description": "RFC 3339: alerts started before (paging).",
            "explode": false,
            "in": "query",
            "name": "before",
            "schema": {
              "description": "RFC 3339: alerts started before (paging).",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 100,
              "format": "int64",
              "maximum": 500,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Alert instances",
        "tags": [
          "alerts"
        ]
      }
    },
    "/alerts/{id}": {
      "get": {
        "description": "Requires `alerts.read` (scoped like the list). Events are every transition: pending, firing, severity, resolved, acknowledged, notified.",
        "operationId": "getAlert",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "One alert with its history",
        "tags": [
          "alerts"
        ]
      }
    },
    "/alerts/{id}/ack": {
      "post": {
        "description": "Requires `alerts.manage`. 409 `conflict` when the alert is resolved or already acknowledged. Audited `alert.acknowledged`.",
        "operationId": "ackAlert",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AckAlertInputBody"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Acknowledge an open alert (stops repeat notifications)",
        "tags": [
          "alerts"
        ]
      }
    },
    "/api-keys": {
      "get": {
        "description": "Requires `apikeys.manage`: admins see every key of the organization, resellers and clients their own. Never the token.",
        "operationId": "listApiKeys",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Only keys of this kind.",
            "explode": false,
            "in": "query",
            "name": "kind",
            "schema": {
              "description": "Only keys of this kind.",
              "enum": [
                "personal",
                "organization"
              ],
              "type": "string"
            }
          },
          {
            "description": "Only the keys acting as this user (admins; others see only their own keys anyway).",
            "explode": false,
            "in": "query",
            "name": "user_id",
            "schema": {
              "description": "Only the keys acting as this user (admins; others see only their own keys anyway).",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Also list revoked keys.",
            "explode": false,
            "in": "query",
            "name": "include_revoked",
            "schema": {
              "description": "Also list revoked keys.",
              "type": "boolean"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAPIKeyView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List API keys",
        "tags": [
          "api-keys"
        ]
      },
      "post": {
        "description": "Requires `apikeys.manage`; an `organization` key needs it at the organization scope and acts as a new service user (an admin). 422 `invalid_scope` / `invalid_ip_allowlist`. Created with a key: needs `apikeys:write`, and the new key's scopes, expiry, allowlist and rate limit may be no wider than the calling key's (403 `api_key_wider_than_caller`): a key with an allowlist creates keys with a non-empty allowlist inside it. Audited `api_key.create`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createApiKey",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateAPIKeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyTokenBody"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create an API key (token shown once)",
        "tags": [
          "api-keys"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/api-keys/scopes": {
      "get": {
        "description": "Every resource with the permissions its `read` and `write` scopes cover, and the wildcards. A key may do what its user may do AND what a scope covers; on GET requests a resource's `read` scope also covers its write permissions, except the strict ones (one-time secrets, files, backup downloads). Impersonation is never possible with a key.",
        "operationId": "getApiKeyScopes",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyScopesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The API key scope catalog",
        "tags": [
          "api-keys"
        ]
      }
    },
    "/api-keys/{id}": {
      "delete": {
        "description": "The key stops working at once (401 `invalid_api_key`). Revoking a revoked key changes nothing. Audited `api_key.revoke`.",
        "operationId": "revokeApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Revoke an API key",
        "tags": [
          "api-keys"
        ]
      },
      "get": {
        "operationId": "getApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get an API key",
        "tags": [
          "api-keys"
        ]
      },
      "patch": {
        "description": "The expiry is fixed at creation. 409 when the key is revoked. With a key: the target key, before and after the change, may be no wider than the calling key. Audited `api_key.update`.",
        "operationId": "updateApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateAPIKeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Rename an API key or change its scopes, allowlist or rate limit",
        "tags": [
          "api-keys"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/api-keys/{id}/rotate": {
      "post": {
        "description": "The key keeps its id, scopes and history; the old token keeps working for `grace_seconds` (at most 24 h). A personal key is rotated only by its owner (or a key acting as the owner). Audited `api_key.rotate`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "rotateApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateAPIKeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyTokenBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Rotate an API key's secret (new token shown once)",
        "tags": [
          "api-keys"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/api-keys/{id}/usage": {
      "get": {
        "operationId": "getApiKeyUsage",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Days back, today included (UTC).",
            "explode": false,
            "in": "query",
            "name": "days",
            "schema": {
              "default": 30,
              "description": "Days back, today included (UTC).",
              "format": "int64",
              "maximum": 90,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/APIKeyUsageOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Daily request counts of an API key",
        "tags": [
          "api-keys"
        ]
      }
    },
    "/audit": {
      "get": {
        "description": "Filters: actor (also matches impersonated subjects), action prefix, object, account and a time range. Actors are resolved at read time; a pseudonymized user shows as deleted.",
        "operationId": "listAuditEvents",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Events done by this user, or on its behalf.",
            "explode": false,
            "in": "query",
            "name": "actor_user_id",
            "schema": {
              "description": "Events done by this user, or on its behalf.",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Action, or a prefix of it (e.g. site. or site.launch).",
            "explode": false,
            "in": "query",
            "name": "action",
            "schema": {
              "description": "Action, or a prefix of it (e.g. site. or site.launch).",
              "maxLength": 100,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "object_type",
            "schema": {
              "maxLength": 100,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "object_id",
            "schema": {
              "maxLength": 200,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "account_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Events at or after this time (RFC 3339).",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Events at or after this time (RFC 3339).",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Events before this time (RFC 3339).",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Events before this time (RFC 3339).",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAuditView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Search the organization's audit events, newest first (audit.read)",
        "tags": [
          "audit"
        ]
      }
    },
    "/audit/chain": {
      "get": {
        "description": "Alerts and verification findings are listed for the operator tenant only.",
        "operationId": "getAuditChain",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditChainView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Audit chain status: sealed head, verifications, anchors with WORM state, alerts (audit.read)",
        "tags": [
          "audit"
        ]
      }
    },
    "/audit/chain/alerts/{id}/ack": {
      "post": {
        "description": "Records who and why; a break is permanent history and is never re-sealed. Audited audit.alert_ack.",
        "operationId": "ackAuditChainAlert",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "int64",
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AckAuditAlertInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditAlertView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Acknowledge a chain alert (operator tenant, security.manage)",
        "tags": [
          "audit"
        ]
      }
    },
    "/audit/chain/verify": {
      "post": {
        "description": "Seals pending events, then verifies (incremental, full or a seq range) and every anchor. Audited audit.verify.",
        "operationId": "verifyAuditChain",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VerifyAuditChainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditVerificationView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Verify the audit chain now (operator tenant, security.manage)",
        "tags": [
          "audit"
        ]
      }
    },
    "/audit/export": {
      "get": {
        "description": "Streamed, audited (audit.export) and limited to 5 exports per hour per user (429 with Retry-After).",
        "operationId": "exportAuditEvents",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "format",
            "schema": {
              "default": "csv",
              "enum": [
                "csv",
                "json"
              ],
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {},
              "text/csv": {}
            },
            "description": "CSV (id,seq,hash,created_at,actor_user_id,on_behalf_of_user_id,account_id,action,object_type,object_id,details) or a JSON array."
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Export the organization's audit log as CSV or JSON, with chain seq and hash (audit.export)",
        "tags": [
          "audit"
        ]
      }
    },
    "/audit/mine": {
      "get": {
        "description": "Admins: the organization. Resellers: their accounts and their own actions. Clients: their accounts and their own actions. Other people's IP addresses are not shown to resellers and clients.",
        "operationId": "listMyAuditEvents",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Action, or a prefix of it.",
            "explode": false,
            "in": "query",
            "name": "action",
            "schema": {
              "description": "Action, or a prefix of it.",
              "maxLength": 100,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "object_type",
            "schema": {
              "maxLength": 100,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "object_id",
            "schema": {
              "maxLength": 200,
              "type": "string"
            }
          },
          {
            "description": "One of the caller's accounts (404 otherwise).",
            "explode": false,
            "in": "query",
            "name": "account_id",
            "schema": {
              "description": "One of the caller's accounts (404 otherwise).",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAuditView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The audit of what the caller reaches (audit.read_own)",
        "tags": [
          "audit"
        ]
      }
    },
    "/auth/device/code": {
      "post": {
        "description": "Public (no session, no CSRF; JSON only). Returns a secret `device_code` for the CLI and a `user_code` the person approves at `verification_uri` after signing in to the panel (2FA and passkeys as usual). 10 per minute and 5 pending requests per address (429 `rate_limited`).",
        "operationId": "deviceCode",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceCodeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceCodeOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "CLI login: start a device authorization",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/device/token": {
      "post": {
        "description": "Public. 400 `authorization_pending` until the person decides; `slow_down` when polled faster than `interval` (which then grows by 5 s); `access_denied` when denied; `expired_token` after 10 minutes, for an unknown code and once the key was handed out. The first poll after approval mints a personal API key (source `device`, name \"CLI: \u003cclient_name\u003e\", the approved scopes, 90 days unless chosen otherwise) and returns its token once. Audited `api_key.create`.",
        "operationId": "deviceToken",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeviceTokenInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceTokenOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "CLI login: poll for the API key",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false,
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/device/{user_code}": {
      "get": {
        "description": "Session only (API keys cannot approve logins). Requires `apikeys.manage`. Case and the dash of the code do not matter.",
        "operationId": "getDeviceRequest",
        "parameters": [
          {
            "in": "path",
            "name": "user_code",
            "required": true,
            "schema": {
              "maxLength": 20,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceRequestView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "CLI login: show a request before approving it",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/device/{user_code}/approve": {
      "post": {
        "description": "Session only; requires `apikeys.manage` and a step-up (POST /auth/step-up) within 5 minutes (403 `step_up_required`), like adding a second factor; refused while acting as another user. 409 when the request is no longer pending. The key is minted on the CLI's next poll. Audited `device.approve` (refusals `device.refused`).",
        "operationId": "approveDeviceRequest",
        "parameters": [
          {
            "in": "path",
            "name": "user_code",
            "required": true,
            "schema": {
              "maxLength": 20,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ApproveDeviceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeviceRequestView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "CLI login: approve (needs a recent step-up)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/device/{user_code}/deny": {
      "post": {
        "description": "Session only; requires `apikeys.manage`. The CLI's next poll answers `access_denied`. Audited `device.deny`.",
        "operationId": "denyDeviceRequest",
        "parameters": [
          {
            "in": "path",
            "name": "user_code",
            "required": true,
            "schema": {
              "maxLength": 20,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "204": {
            "description": "No Content",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "CLI login: deny",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/impersonation": {
      "delete": {
        "description": "Ends the impersonation and clears its cookie; the real session continues. Audited `impersonation.end`.",
        "operationId": "endImpersonation",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Stop acting as another user",
        "tags": [
          "auth"
        ]
      },
      "post": {
        "description": "Requires `impersonate`: admins act as any active client of the organization, resellers as a client all of whose accounts they own. Never an admin or a reseller, never oneself, never from inside an impersonation (403 `impersonation_forbidden`); 10 per hour per user (429). Sets the `pp_impersonation` cookie; while it is live every request runs as the client and every audit row names both users (actor = the real user, on_behalf_of = the client). Passwords, users, grants and organization settings are refused meanwhile. Audited `impersonation.start`. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "startImpersonation",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StartImpersonationInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              },
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Act as a client user (30 minutes)",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/invite/accept": {
      "post": {
        "description": "400 `token_invalid`, 410 `token_used` / `token_expired`. Rate-limited like the login. Sets the session cookies.",
        "operationId": "acceptInvite",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenPasswordInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "410": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gone"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Accept an invitation: set the password and log in",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/login": {
      "post": {
        "description": "Sets the `pp_session` (HttpOnly) and `pp_csrf` cookies. The organization is optional (ADR-0002 amendment 2026-10-11): the panel host's organization when the host belongs to one, else the organization of the email. When the credentials are valid in several organizations the answer is 409 `organization_required` with `organizations` (only after a correct password); repeat the request with `tenant`. Rate limited per IP and per email.\n\nM22 (ADR-0013 §2): a user with a second factor gets 200 `{\"mfa_required\":true,\"methods\":[…]}` and the `pp_mfa` cookie instead of a session; POST /auth/mfa/* completes the login. A user whose organization requires a factor they have not enrolled gets a session with `mfa_pending`. 20 failed sign-ins from one IP in 10 minutes ban it for 15 minutes (429 `login_banned`).",
        "operationId": "login",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Log in with email and password",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/logout": {
      "post": {
        "operationId": "logout",
        "responses": {
          "204": {
            "description": "No Content",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Revoke the current session",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/me": {
      "get": {
        "operationId": "getMe",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Current user, tenant, roles and permissions",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/mfa": {
      "get": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). ",
        "operationId": "getMFAStatus",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MFAStatusBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "My second factors",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/mfa/recovery": {
      "post": {
        "description": "Dashes, spaces and case are ignored. The user is notified by e-mail when SMTP is configured. Same errors as loginTOTP.",
        "operationId": "loginRecoveryCode",
        "parameters": [
          {
            "in": "cookie",
            "name": "pp_mfa",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MFACodeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Second login step: a recovery code (single use)",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/mfa/recovery-codes": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Replaces the set and signs out the other sessions. 409 `mfa_not_enabled`. Audited. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`). The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "regenerateRecoveryCodes",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NewRecoveryCodesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "New recovery codes (shown once)",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/mfa/totp": {
      "delete": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). 409 `mfa_required_by_policy` when it is the last factor and the organization requires one. Removing the last factor deletes the recovery codes, signs out the other sessions and notifies the user. Audited. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`).",
        "operationId": "removeTOTP",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Remove the authenticator app",
        "tags": [
          "auth"
        ]
      },
      "post": {
        "description": "Needs the `pp_mfa` cookie from POST /auth/login. 401 `mfa_invalid_code` (5 tries per challenge), 401 `mfa_challenge_invalid` (log in again). Sets the session cookies.",
        "operationId": "loginTOTP",
        "parameters": [
          {
            "in": "cookie",
            "name": "pp_mfa",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MFACodeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Second login step: an authenticator app code",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/mfa/totp/confirm": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). 422 `mfa_invalid_code`, 409 `totp_not_pending`. When it is the first factor the answer carries 10 recovery codes (shown once), and a session waiting for enrollment becomes a full session. The user is notified that a factor was added. Audited. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "confirmTOTP",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CodeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryCodesBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Confirm the authenticator app with a first code",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/mfa/totp/enroll": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Answers a new secret and its otpauth:// URI (shown once; the secret is sealed in the vault). Restarting an unconfirmed enrollment replaces the secret. 409 `totp_already_enabled`, 503 `mfa_unavailable`. Audited. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`). The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "enrollTOTP",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TOTPEnrollOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Start enrolling an authenticator app",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/mfa/webauthn/begin": {
      "post": {
        "description": "409 `passkey_unavailable_here` when none of the user's passkeys works on this host.",
        "operationId": "loginWebAuthnBegin",
        "parameters": [
          {
            "in": "cookie",
            "name": "pp_mfa",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebAuthnOptionsBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Second login step with a passkey: get the assertion options",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/mfa/webauthn/finish": {
      "post": {
        "operationId": "loginWebAuthnFinish",
        "parameters": [
          {
            "in": "cookie",
            "name": "pp_mfa",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CredentialInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Second login step with a passkey: verify the assertion",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/passkey/begin": {
      "post": {
        "description": "Discoverable credentials with user verification (counts as two factors). The RP ID is this host: a platform panel host or an organization's panel host (400 `passkey_host_unsupported` otherwise). Sets `pp_mfa`.",
        "operationId": "passkeyLoginBegin",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebAuthnOptionsBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Passwordless sign-in with a passkey: get the options",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/passkey/finish": {
      "post": {
        "description": "On an organization's panel host only that organization's users sign in. 401 `passkey_invalid`. Sets the session cookies.",
        "operationId": "passkeyLoginFinish",
        "parameters": [
          {
            "in": "cookie",
            "name": "pp_mfa",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CredentialInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Passwordless sign-in with a passkey: verify and log in",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/passkeys": {
      "get": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). ",
        "operationId": "listPasskeys",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeysOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "My passkeys (with the address each works on)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/passkeys/register/begin": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). The RP ID is this request's host (400 `passkey_host_unsupported` when passkeys do not work here). Discoverable credential, user verification required. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`). The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "beginPasskeyRegistration",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyRegisterBeginOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Start registering a passkey on this address",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/passkeys/register/finish": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). 422 `passkey_invalid`. When it is the first factor the answer carries 10 recovery codes (shown once). Audited. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`). The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "finishPasskeyRegistration",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyRegisterFinishInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyRegisterFinishOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Verify and store a new passkey",
        "tags": [
          "auth"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/auth/passkeys/{id}": {
      "delete": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Same rules as removing the authenticator app. Audited. Needs a step-up within 5 minutes (POST /auth/step-up; 403 `step_up_required`).",
        "operationId": "removePasskey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Remove a passkey",
        "tags": [
          "auth"
        ]
      },
      "patch": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Audited.",
        "operationId": "renamePasskey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenamePasskeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Rename a passkey",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/password": {
      "post": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Needs the current password (401 `invalid_credentials`, rate limited like the login). The organization's password policy applies (422 `password_too_short` / `password_too_common` / `password_contains_email`). Signs out the other sessions. Audited.",
        "operationId": "changePassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ChangePasswordInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Change my password",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/password-reset/complete": {
      "post": {
        "description": "Revokes the user's other sessions. Same errors as acceptInvite.",
        "operationId": "completePasswordReset",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenPasswordInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": false,
                  "properties": {
                    "api_key": {
                      "$ref": "#/components/schemas/MeAPIKey",
                      "description": "Present when the request was made with an API key: the key the caller authenticated with."
                    },
                    "impersonation": {
                      "$ref": "#/components/schemas/ImpersonationView",
                      "description": "Present while acting as another user: the banner \"Acting as X — exit\"."
                    },
                    "methods": {
                      "description": "With mfa_required: the factors this user can give here (totp, webauthn, recovery).",
                      "items": {
                        "enum": [
                          "totp",
                          "webauthn",
                          "recovery"
                        ],
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "mfa_pending": {
                      "description": "True while the organization's policy requires a second factor the user has not enrolled: every other API answers 403 mfa_enrollment_required until one is enrolled.",
                      "type": "boolean"
                    },
                    "mfa_required": {
                      "description": "True when a second factor must follow (POST /auth/mfa/*); no session exists yet and the other fields are absent.",
                      "type": "boolean"
                    },
                    "permissions": {
                      "description": "Every permission the user holds, at any scope, sorted.",
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "roles": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    },
                    "scopes": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "Permission → scope: tenant (whole organization), account (accounts the reseller owns or the client is attached to), own (objects the user created).",
                      "type": "object"
                    },
                    "tenant": {
                      "$ref": "#/components/schemas/TenantView"
                    },
                    "user": {
                      "$ref": "#/components/schemas/UserView"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Set-Cookie": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "410": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gone"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Complete a password reset and log in",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/auth/sessions": {
      "delete": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). Audited.",
        "operationId": "revokeMyOtherSessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokedOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Sign out all my other sessions",
        "tags": [
          "auth"
        ]
      },
      "get": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). ",
        "operationId": "listMySessions",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SessionsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "My live sessions",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/sessions/{id}": {
      "delete": {
        "description": "Self-service: no permission needed; refused while acting as another user (403 `impersonation_forbidden`). 409 `session_current` for this session (use POST /auth/logout). Audited.",
        "operationId": "revokeMySession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Sign out one of my other sessions",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/step-up": {
      "post": {
        "description": "Adding or removing an authenticator app or a passkey and new recovery codes answer 403 `step_up_required` unless the session re-authenticated within 5 minutes (a session waiting for its first factor starts re-authenticated). Exactly one of `password` and `code`. 401 `invalid_credentials` / `mfa_invalid_code`, 429 `rate_limited` / `mfa_locked`. Wrong codes count toward the second-factor lockout, wrong passwords toward the address ban. Refused while acting as another user. Audited.",
        "operationId": "stepUp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StepUpInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StepUpOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          }
        ],
        "summary": "Confirm it is you (password or authenticator code) before changing second factors",
        "tags": [
          "auth"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/backup-exports/{id}": {
      "get": {
        "description": "`backups.restore`.",
        "operationId": "getBackupExport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupExportView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A download archive (with its link when ready)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups": {
      "get": {
        "description": "`backups.manage`.",
        "operationId": "getBackupOverview",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupOverviewOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's backups: settings, quotas, fleet, open alerts (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/alerts": {
      "get": {
        "description": "`backups.manage`. Failed runs, quota, failed checks, failed restore tests and restores.",
        "operationId": "listBackupAlerts",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "include_resolved",
            "schema": {
              "type": "boolean"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 100,
              "format": "int32",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupAlertListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Backup alerts (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/alerts/{id}/ack": {
      "post": {
        "description": "`backups.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "ackBackupAlert",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "204": {
            "description": "No Content",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Acknowledge a backup alert (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/byo-s3": {
      "delete": {
        "description": "`backups.manage`. Its repositories stay in the bucket. Audited. Requires `X-CSRF-Token`.",
        "operationId": "deleteBackupBYO",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BYOView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the organization's own S3 destination (admin)",
        "tags": [
          "backups"
        ]
      },
      "get": {
        "description": "`backups.manage`. Never the secret key.",
        "operationId": "getBackupBYO",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BYOView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's own S3 destination (admin)",
        "tags": [
          "backups"
        ]
      },
      "put": {
        "description": "`backups.manage`; edition feature `backup_byo_s3`. Checked by listing the bucket, then stored encrypted in the organization's vault; the credentials never reach a server (agents get presigned URLs). Audited. Requires `X-CSRF-Token`.",
        "operationId": "putBackupBYO",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BYOInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BYOView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Store the organization's own S3 destination (Enterprise)",
        "tags": [
          "backups"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/backups/runs": {
      "get": {
        "description": "`backups.manage`.",
        "operationId": "listBackupRuns",
        "parameters": [
          {
            "description": "Only this server.",
            "explode": false,
            "in": "query",
            "name": "server_id",
            "schema": {
              "description": "Only this server.",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int32",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupRunListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Backup runs, newest first (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/servers/{id}": {
      "put": {
        "description": "`backups.manage`. Omitted fields follow the organization. Audited. Requires `X-CSRF-Token`.",
        "operationId": "putBackupServerSettings",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupServerSettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerSettings"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a server's backup overrides (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/servers/{id}/maintenance": {
      "post": {
        "description": "`backups.manage`. The scheduler runs both on its own (prune after each run, a sample check after each prune, a full check monthly). Audited. Requires `X-CSRF-Token`.",
        "operationId": "runServerBackupMaintenance",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupMaintenanceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Prune or check a server's repository now (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/servers/{id}/run": {
      "post": {
        "description": "`backups.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "runServerBackup",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupJobOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Back a whole server up now (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/settings": {
      "put": {
        "description": "`backups.manage`. Window and period (UTC), tier, retention (Pro and above; Free keeps 7 daily), the hold of deleted accounts, bandwidth limits. Audited. Requires `X-CSRF-Token`.",
        "operationId": "putBackupSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupSettingsView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace the organization's backup settings (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/test-quota": {
      "put": {
        "description": "`backups.manage` and the explicit permission `jobs.test_probes`. The squeeze then runs as if the quota were this small (the next prune tightens retention and warns). 0 clears. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setBackupTestQuota",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupTestQuotaInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupOverviewOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Cap the organization's backup quota (lab drill hook)",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/tests": {
      "get": {
        "description": "`backups.manage`. Monthly per organization (quarterly on Free).",
        "operationId": "listBackupTests",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupTestListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Automatic restore tests (admin)",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "`backups.manage`. Restores a random account (or `account_id`) into a sandbox on its server, checks it (HTTP 200, a database query, file checksums) and deletes the sandbox. Audited. Requires `X-CSRF-Token`.",
        "operationId": "forceBackupTest",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ForceBackupTestInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupTestView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Run a restore test now (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/branding": {
      "get": {
        "description": "Public: the login page of a panel host renders with it. With a session it is the caller's organization; without one, the organization whose panel host is the request host; otherwise empty (PlusPanel defaults). Nothing but the branding is revealed.",
        "operationId": "getBranding",
        "parameters": [
          {
            "description": "Cache-buster (ignored).",
            "explode": false,
            "in": "query",
            "name": "v",
            "schema": {
              "description": "Cache-buster (ignored).",
              "maxLength": 20,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "The branding the panel shows: the caller's organization, else the request host's",
        "tags": [
          "tenant"
        ]
      }
    },
    "/branding/logo": {
      "get": {
        "operationId": "getBrandingLogo",
        "parameters": [
          {
            "description": "Cache-buster (ignored).",
            "explode": false,
            "in": "query",
            "name": "v",
            "schema": {
              "description": "Cache-buster (ignored).",
              "maxLength": 20,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "contentEncoding": "base64",
                  "type": "string"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "Content-Disposition": {
                "schema": {
                  "type": "string"
                }
              },
              "Content-Type": {
                "schema": {
                  "type": "string"
                }
              },
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "The logo of the branding GET /branding describes",
        "tags": [
          "tenant"
        ]
      }
    },
    "/catalog": {
      "get": {
        "operationId": "listCatalog",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the application image catalog (admin)",
        "tags": [
          "services"
        ]
      }
    },
    "/db-services/{id}": {
      "delete": {
        "description": "Two steps: POST /db-services/{id}/removal-token, then DELETE with `confirm_token`. Enqueues `remove_db_service`: the container goes, the data moves to the account's quarantine, bindings become broken (the sites lose the variables). Audited.",
        "operationId": "removeDBService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "From POST /db-services/{id}/removal-token.",
            "explode": false,
            "in": "query",
            "name": "confirm_token",
            "schema": {
              "description": "From POST /db-services/{id}/removal-token.",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a database service (admin)",
        "tags": [
          "databases"
        ]
      },
      "get": {
        "operationId": "getDBService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a database service with its databases, users, bindings and phpMyAdmin sessions (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/databases": {
      "post": {
        "description": "Enqueues `create_database`. Redis has no named databases (422). One mutating job per service (409). Audited.",
        "operationId": "createDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DBNameInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a database (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/databases/{name}": {
      "delete": {
        "description": "Enqueues `drop_database`; 409 `db_bound` while a site binding uses it. Audited.",
        "operationId": "dropDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Drop a database (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/dumps": {
      "post": {
        "description": "Enqueues `dump_database`: an engine-native dump into db-services/\u003ckey\u003e/dumps (counted in the account's quota; `dbsvc_quota_exceeded` when it is full). The newest 5 per database are kept. Audited.",
        "operationId": "dumpDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DBDumpInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Dump a database into the account's volume (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/park": {
      "post": {
        "description": "Enqueues `park_db_service`: the container stops and stays stopped across reboots. 409 `db_bound` while a site is bound (its next start would wake it). Audited.",
        "operationId": "parkDBService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Park a database service (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/pma-sessions": {
      "post": {
        "description": "MariaDB only. Enqueues `mint_pma_session`: the agent starts (or reuses) the account's phpMyAdmin on a random path of a site name that serves HTTPS and returns a one-time login URL (valid at most 5 minutes, single use). The URL is read exactly once with GET /jobs/{id}/sensitive (needs jobs.manage). phpMyAdmin stops after 30 minutes without requests. Audited, and every session state change too. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "mintPMASession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PMASessionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Open phpMyAdmin for one database (admin)",
        "tags": [
          "databases"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/db-services/{id}/removal-token": {
      "post": {
        "description": "The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "dbServiceRemovalToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RemovalTokenOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get the confirm token to remove a database service (admin)",
        "tags": [
          "databases"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/db-services/{id}/users": {
      "post": {
        "description": "Enqueues `create_db_user`: the agent generates the password once and keeps it on the server only; re-running converges the grants to exactly `databases`. Audited.",
        "operationId": "putDBUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DBUserInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a database user or set its grants (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/users/{name}": {
      "delete": {
        "description": "Enqueues `drop_db_user`; 409 `db_bound` while a site binding uses it. Audited.",
        "operationId": "dropDBUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Drop a database user (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/version": {
      "patch": {
        "description": "Upgrade only: 409 `downgrade_refused` for a lower version (restore a backup into a new service instead). Enqueues `set_db_service_version`: the agent snapshots first (engine dump + data clone), moves to the new version (in place, or dump/restore for a PostgreSQL major), checks the engine's inventory and rolls back to the snapshot on any failure (`version_error`). `force_failure` needs a lab server and `jobs.test_probes` (403). Audited.",
        "operationId": "setDBServiceVersion",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DBVersionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Upgrade a database service (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-services/{id}/wake": {
      "post": {
        "operationId": "wakeDBService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBServiceActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Wake a parked database service (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-versions": {
      "get": {
        "operationId": "listDBVersions",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBEngineVersionListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the database engine versions (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/db-versions/{engine}/{version}": {
      "patch": {
        "description": "Platform data: admins of the operator tenant only (403 otherwise). Sets the status (supported, deprecated, disabled) and/or makes the version the engine's default (it must be supported). The agent's own version table stays the hard limit. Audited. Requires `X-CSRF-Token`.",
        "operationId": "updateDBVersion",
        "parameters": [
          {
            "in": "path",
            "name": "engine",
            "required": true,
            "schema": {
              "enum": [
                "mariadb",
                "postgres",
                "redis"
              ],
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateDBEngineVersionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DBEngineVersionView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Edit a database engine version (operator admin only)",
        "tags": [
          "databases"
        ]
      }
    },
    "/dns/nameservers": {
      "get": {
        "description": "The configured PowerDNS primaries (ADR-0008) as the sync engine last saw them. Empty when none is configured.",
        "operationId": "listDNSNameservers",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NameserverListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the nameservers and their health (admin)",
        "tags": [
          "dns"
        ]
      }
    },
    "/dns/zones": {
      "get": {
        "operationId": "listDNSZones",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the tenant's DNS zones (admin)",
        "tags": [
          "dns"
        ]
      },
      "post": {
        "description": "Creates the zone with the platform's SOA and NS records and the optional template records; the sync engine pushes it to every nameserver within seconds. 409 `zone_exists` (zone names are unique on the platform), 403 `zone_reserved` for a name at or below the operator's own domains outside the operator tenant, 422 for invalid names or template values. Audited. Requires `X-CSRF-Token`.",
        "operationId": "createDNSZone",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateZoneInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a DNS zone (admin)",
        "tags": [
          "dns"
        ]
      }
    },
    "/dns/zones/{id}": {
      "delete": {
        "description": "Marks the zone removing: the sync engine deletes it from every nameserver, then the zone and its records go. 409 while DNSSEC is on with the DS published (unpublish it at the parent first). Audited. Requires `X-CSRF-Token`.",
        "operationId": "deleteDNSZone",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete a DNS zone (admin)",
        "tags": [
          "dns"
        ]
      },
      "get": {
        "operationId": "getDNSZone",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a DNS zone with its sync and DNSSEC state (admin)",
        "tags": [
          "dns"
        ]
      },
      "patch": {
        "description": "active or shadow (both are served; shadow marks a zone not delegated yet). Audited. Requires `X-CSRF-Token`.",
        "operationId": "updateDNSZone",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateZoneInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a zone's status (admin)",
        "tags": [
          "dns"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/dns/zones/{id}/dnssec": {
      "put": {
        "description": "On: the sync engine creates one signing key (CSK, ECDSAP256SHA256) on one nameserver and copies it to the other, so both sign with the same key; `dnssec.ds` then holds the DS for the parent. Off: 409 `ds_published` while the DS is published (remove it at the parent and PUT /dnssec/ds-published false first). Audited. Requires `X-CSRF-Token`.",
        "operationId": "setDNSZoneDNSSEC",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetDNSSECInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Switch DNSSEC for a zone (admin)",
        "tags": [
          "dns"
        ]
      }
    },
    "/dns/zones/{id}/dnssec/ds-published": {
      "put": {
        "description": "409 `dnssec_not_ready` to publish before the zone has a key. The published key tag is kept: a later key change shows as `ds_mismatch`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setDNSZoneDSPublished",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetDSPublishedInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZoneView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Record whether the DS is published at the parent (admin)",
        "tags": [
          "dns"
        ]
      }
    },
    "/dns/zones/{id}/records": {
      "get": {
        "operationId": "listDNSRecords",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecordListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a zone's records (admin)",
        "tags": [
          "dns"
        ]
      },
      "post": {
        "description": "Validates the record (422) and the zone's rules (409 `record_conflict`: a CNAME is alone at its name and never at the apex, a delegation shares its name with nothing, the apex NS belongs to the platform, no duplicate). The record's TTL becomes the TTL of its whole RRset. Audited. Requires `X-CSRF-Token`.",
        "operationId": "createDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecordBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecordView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Add a record (admin)",
        "tags": [
          "dns"
        ]
      },
      "put": {
        "description": "Validates every record and the resulting set as a whole, then replaces all records except DNS-01 challenge values in one transaction (one serial bump per record). Audited as an import. Requires `X-CSRF-Token`.",
        "operationId": "replaceDNSRecords",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReplaceRecordsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecordListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace every record of a zone (admin; imports)",
        "tags": [
          "dns"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/dns/zones/{id}/records/{record_id}": {
      "delete": {
        "description": "409 `record_managed` for DNS-01 challenge values. Audited. Requires `X-CSRF-Token`.",
        "operationId": "deleteDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "record_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete a record (admin)",
        "tags": [
          "dns"
        ]
      },
      "put": {
        "description": "As POST; a template or site record becomes a user record. 409 `record_managed` for DNS-01 challenge values. Audited. Requires `X-CSRF-Token`.",
        "operationId": "updateDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "record_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecordBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecordView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace a record (admin)",
        "tags": [
          "dns"
        ]
      }
    },
    "/geoip": {
      "get": {
        "description": "Any role with `security.waf`. The attribution (IP Geolocation by DB-IP, CC BY 4.0) must be shown wherever countries are chosen.",
        "operationId": "getGeoIP",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GeoIPOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The GeoIP database version, the selectable countries and the DB-IP attribution",
        "tags": [
          "security"
        ]
      }
    },
    "/healthz": {
      "get": {
        "operationId": "healthz",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Liveness: the process is serving",
        "tags": [
          "health"
        ]
      }
    },
    "/jobs/{id}": {
      "get": {
        "operationId": "getJob",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a job",
        "tags": [
          "jobs"
        ]
      }
    },
    "/jobs/{id}/cancel": {
      "post": {
        "operationId": "cancelJob",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Cancel a pending job (admin)",
        "tags": [
          "jobs"
        ]
      }
    },
    "/jobs/{id}/sensitive": {
      "get": {
        "description": "Requires `jobs.sensitive` (admins: any job of the organization; resellers and clients: the jobs they created). Returns the reserved `sensitive` member of a succeeded job's result (a generated WordPress administrator password) exactly once: the control plane keeps it only in process memory for 15 minutes and stores it nowhere. Every later call, another tenant's call, a call after the TTL and a call after a control plane restart answer 404. `Cache-Control: no-store`. The read is audited without the value.",
        "operationId": "readJobSensitive",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SensitiveOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Read the one-time secret of a job result",
        "tags": [
          "jobs"
        ]
      }
    },
    "/licenses/check-in": {
      "post": {
        "description": "Public. Answers `valid`, `revoked` or `unknown` for the license id and records the check-in. Rate-limited per IP. Installations fail open: no answer changes nothing on their side.",
        "operationId": "licenseCheckIn",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckInInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckInResponse"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "License server: a self-hosted installation reports in",
        "tags": [
          "operator"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/mail/aliases/{id}": {
      "delete": {
        "operationId": "removeMailAlias",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailAliasActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove an alias",
        "tags": [
          "mail"
        ]
      },
      "patch": {
        "operationId": "updateMailAlias",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateMailAliasInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailAliasActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change an alias's target mailboxes",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/domains/{id}": {
      "delete": {
        "description": "Mailbox data goes to the trash for 7 days unless `purge=true`. Audited.",
        "operationId": "removeMailDomain",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Delete the mail data at once instead of keeping it 7 days in the trash.",
            "explode": false,
            "in": "query",
            "name": "purge",
            "schema": {
              "description": "Delete the mail data at once instead of keeping it 7 days in the trash.",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a mail domain with its mailboxes and aliases",
        "tags": [
          "mail"
        ]
      },
      "get": {
        "operationId": "getMailDomain",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A mail domain",
        "tags": [
          "mail"
        ]
      },
      "patch": {
        "operationId": "updateMailDomain",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateMailDomainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a mail domain (enabled, DMARC, MTA-STS)",
        "tags": [
          "mail"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/mail/domains/{id}/aliases": {
      "get": {
        "operationId": "listMailAliases",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailAliasListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The aliases of a mail domain",
        "tags": [
          "mail"
        ]
      },
      "post": {
        "operationId": "createMailAlias",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailAliasInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailAliasActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create an alias to mailboxes of the same account",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/domains/{id}/dkim/rotate": {
      "post": {
        "operationId": "rotateMailDKIM",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDomainActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Start a DKIM key rotation now",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/domains/{id}/dns": {
      "get": {
        "operationId": "getMailDomainDNS",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDNSView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The records of a mail domain and their last check",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/domains/{id}/dns/verify": {
      "post": {
        "description": "Public recursive resolution of every expected record; at most once per 10 minutes (429 `mail_dns_check_too_soon`).",
        "operationId": "verifyMailDomainDNS",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailDNSView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Check the records of a mail domain now",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/domains/{id}/mailboxes": {
      "get": {
        "operationId": "listMailboxes",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The mailboxes of a mail domain",
        "tags": [
          "mail"
        ]
      },
      "post": {
        "description": "Quota and hourly send limit default to the account's plan (`mailbox_quota_bytes`, `mail_send_limit_per_hour`); above them needs `accounts.override`. A chosen password must pass the organization's policy (422 `password_*`) and is sealed to the server's key; without one a password is generated and shown once through `GET /jobs/{id}/sensitive`. 409 `edition_limit_reached` (Free: 10 mailboxes), `mail_address_taken`, `mail_domain_not_ready`. Audited.",
        "operationId": "createMailbox",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateMailboxInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a mailbox",
        "tags": [
          "mail"
        ]
      }
    },
    "/mail/mailboxes": {
      "get": {
        "operationId": "listMyMailboxes",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Every mailbox the caller reaches",
        "tags": [
          "mail"
        ]
      }
    },
    "/mailboxes/{id}": {
      "delete": {
        "description": "409 `mailbox_alias_target` while an alias delivers to it. Data goes to the trash for 7 days unless `purge=true`. Audited.",
        "operationId": "removeMailbox",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Delete the mail data at once instead of keeping it 7 days in the trash.",
            "explode": false,
            "in": "query",
            "name": "purge",
            "schema": {
              "description": "Delete the mail data at once instead of keeping it 7 days in the trash.",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a mailbox",
        "tags": [
          "mail"
        ]
      },
      "get": {
        "operationId": "getMailbox",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A mailbox with its forward and autoresponder",
        "tags": [
          "mail"
        ]
      },
      "patch": {
        "operationId": "updateMailbox",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateMailboxInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a mailbox (name, quota, send limit, login)",
        "tags": [
          "mail"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/mailboxes/{id}/autoresponder": {
      "put": {
        "operationId": "setMailboxAutoresponder",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailboxAutoresponderInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a mailbox's automatic reply",
        "tags": [
          "mail"
        ]
      }
    },
    "/mailboxes/{id}/client-settings": {
      "get": {
        "operationId": "getMailboxClientSettings",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailClientSettings"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Mail client settings of a mailbox",
        "tags": [
          "mail"
        ]
      }
    },
    "/mailboxes/{id}/forward": {
      "put": {
        "operationId": "setMailboxForward",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailboxForwardInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a mailbox's forwarding (at most 10 addresses)",
        "tags": [
          "mail"
        ]
      }
    },
    "/mailboxes/{id}/import": {
      "post": {
        "operationId": "importMailbox",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailboxImportInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Import mail from the account's files or an IMAP account",
        "tags": [
          "mail"
        ]
      }
    },
    "/mailboxes/{id}/password": {
      "put": {
        "operationId": "setMailboxPassword",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailboxPasswordInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailboxActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a mailbox password (`{password}` or `{generate: true}`)",
        "tags": [
          "mail"
        ]
      }
    },
    "/notification-channels": {
      "get": {
        "description": "Requires `alerts.manage`. Secrets are never returned.",
        "operationId": "listNotificationChannels",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Notification channels",
        "tags": [
          "alerts"
        ]
      },
      "post": {
        "description": "Requires `alerts.manage`. Types: email (addresses), webhook (HTTPS url, optional signing_key: X-PlusPanel-Signature = sha256=HMAC-SHA256 of the body), slack and discord (incoming-webhook url), telegram (bot_token + chat_id). push: 422 `channel_type_unavailable` (M26). Targets must be HTTPS at public addresses (checked again at every connection). Secrets go to the vault (`notify/\u003cid\u003e`): without a vault key 503 `notify_unavailable`. Audited `notification_channel.created` (never the secret).",
        "operationId": "createNotificationChannel",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateChannelInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a notification channel",
        "tags": [
          "alerts"
        ]
      }
    },
    "/notification-channels/{id}": {
      "delete": {
        "description": "Requires `alerts.manage`. Its secret and pending deliveries go with it. Audited `notification_channel.deleted`.",
        "operationId": "deleteNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete a notification channel",
        "tags": [
          "alerts"
        ]
      },
      "patch": {
        "description": "Requires `alerts.manage`. Fields left out stay; `secret` replaces the stored secret. Audited `notification_channel.updated`.",
        "operationId": "updateNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchChannelInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a notification channel",
        "tags": [
          "alerts"
        ]
      }
    },
    "/notification-channels/{id}/deliveries": {
      "get": {
        "description": "Requires `alerts.manage`. Newest first.",
        "operationId": "listChannelDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeliveriesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Recent deliveries of a channel",
        "tags": [
          "alerts"
        ]
      }
    },
    "/notification-channels/{id}/test": {
      "post": {
        "description": "Requires `alerts.manage`. Sends synchronously (10 s timeout) and records the delivery. Audited `notification_channel.tested`.",
        "operationId": "testNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelTestOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Send a test message now",
        "tags": [
          "alerts"
        ]
      }
    },
    "/observability/fleet": {
      "get": {
        "description": "Every server of the organization with its latest telemetry (from the heartbeat; no store read). `observability.read` at tenant scope.",
        "operationId": "getObservabilityFleet",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/FleetOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Fleet health map",
        "tags": [
          "observability"
        ]
      }
    },
    "/observability/logs": {
      "get": {
        "description": "Access, error or system lines, newest first. Central (VictoriaLogs) when the organization opted in and the range lies after the consent and within its log retention, otherwise local (needs server_id, account_id or site_id: 422 `server_required`). `observability.logs`: resellers and clients read their accounts' access and error logs only (a local read names one account); system logs need the tenant scope.",
        "operationId": "listObservabilityLogs",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "server_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "account_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "site_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "system: admins only.",
            "explode": false,
            "in": "query",
            "name": "kind",
            "schema": {
              "default": "access",
              "description": "system: admins only.",
              "enum": [
                "access",
                "error",
                "system"
              ],
              "type": "string"
            }
          },
          {
            "description": "Plain text the line must contain (no query syntax).",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "Plain text the line must contain (no query syntax).",
              "maxLength": 256,
              "type": "string"
            }
          },
          {
            "description": "Access logs: an exact code (100..599) or a class 1..5; 0 = any.",
            "explode": false,
            "in": "query",
            "name": "status",
            "schema": {
              "description": "Access logs: an exact code (100..599) or a class 1..5; 0 = any.",
              "format": "int64",
              "maximum": 599,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "description": "Range start (RFC 3339); default one hour before to.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Range start (RFC 3339); default one hour before to.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Range end (RFC 3339); default now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Range end (RFC 3339); default now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 100,
              "format": "int64",
              "maximum": 1000,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Continuation of a previous page.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Continuation of a previous page.",
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Log lines",
        "tags": [
          "observability"
        ]
      }
    },
    "/observability/logs/download": {
      "get": {
        "description": "The same filters as /observability/logs (limit and cursor ignored), at most 50 000 lines as NDJSON. Audited (`observability.logs_download`) before the first byte.",
        "operationId": "downloadObservabilityLogs",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "server_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "account_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "site_id",
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "system: admins only.",
            "explode": false,
            "in": "query",
            "name": "kind",
            "schema": {
              "default": "access",
              "description": "system: admins only.",
              "enum": [
                "access",
                "error",
                "system"
              ],
              "type": "string"
            }
          },
          {
            "description": "Plain text the line must contain (no query syntax).",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "Plain text the line must contain (no query syntax).",
              "maxLength": 256,
              "type": "string"
            }
          },
          {
            "description": "Access logs: an exact code (100..599) or a class 1..5; 0 = any.",
            "explode": false,
            "in": "query",
            "name": "status",
            "schema": {
              "description": "Access logs: an exact code (100..599) or a class 1..5; 0 = any.",
              "format": "int64",
              "maximum": 599,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "description": "Range start (RFC 3339); default one hour before to.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Range start (RFC 3339); default one hour before to.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Range end (RFC 3339); default now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Range end (RFC 3339); default now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 100,
              "format": "int64",
              "maximum": 1000,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Continuation of a previous page.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Continuation of a previous page.",
              "maxLength": 64,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/x-ndjson": {}
            },
            "description": "NDJSON log lines"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Download log lines (NDJSON)",
        "tags": [
          "observability"
        ]
      }
    },
    "/observability/retention": {
      "get": {
        "description": "Free 7/3, Pro 30/14, Enterprise 90/30 days of metrics/logs. `observability.read` at any scope.",
        "operationId": "getObservabilityRetention",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RetentionOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Central retention of the organization",
        "tags": [
          "observability"
        ]
      }
    },
    "/observability/settings": {
      "get": {
        "description": "`observability.read` at tenant scope.",
        "operationId": "getObservabilitySettings",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ObservabilitySettingsView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Centralization consent and server settings",
        "tags": [
          "observability"
        ]
      },
      "put": {
        "description": "`tenant.manage`. Opting in needs `consent_version` = `obs-central-v1` (422 `consent_required`) and central stores (503 `observability_unavailable`); audited `observability.consent`. Revoking stops the raw upload at once and deletes the organization's raw central data (aggregates stay); audited `observability.consent_revoked`. Server settings (disk cap, local retention) are audited `observability.settings`; every change pushes `set_telemetry_config` to the agents. Requires `X-CSRF-Token`.",
        "operationId": "putObservabilitySettings",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutObservabilitySettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ObservabilitySettingsView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change the centralization consent and server settings",
        "tags": [
          "observability"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/operator/audit/export": {
      "get": {
        "description": "The organization's events with their chain rows, the rows in between as hashes only, the anchors of the period and their public keys. Verify offline with `controlplane audit verify-bundle FILE`. Audited audit.bundle_export; 5 per hour per user.",
        "operationId": "exportAuditBundle",
        "parameters": [
          {
            "description": "Organization slug.",
            "explode": false,
            "in": "query",
            "name": "tenant",
            "required": true,
            "schema": {
              "description": "Organization slug.",
              "maxLength": 100,
              "minLength": 1,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "format": "date-time",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/x-ndjson": {}
            },
            "description": "NDJSON bundle (docs/runbooks/audit-verify.md)."
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Authorities bundle of an organization's audit trail, NDJSON (operator tenant, audit.export)",
        "tags": [
          "audit"
        ]
      }
    },
    "/operator/login-bans": {
      "get": {
        "description": "The operator organization with `security.manage`: active bans and those of the last day.",
        "operationId": "listLoginBans",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginBansOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Panel login bans (operator)",
        "tags": [
          "security"
        ]
      }
    },
    "/operator/login-bans/{id}": {
      "delete": {
        "description": "The operator organization with `security.manage`. Audited `auth.login_ban_lifted`.",
        "operationId": "liftLoginBan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Lift a panel login ban (operator)",
        "tags": [
          "security"
        ]
      }
    },
    "/operator/status/incidents": {
      "get": {
        "description": "The operator organization with `alerts.manage`: open incidents and those of the last 90 days, with their notes.",
        "operationId": "listStatusIncidents",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IncidentsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Status page incidents (operator)",
        "tags": [
          "status"
        ]
      },
      "post": {
        "description": "The operator organization with `alerts.manage`. The body is the first public note. Audited `status.incident_created`.",
        "operationId": "createStatusIncident",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateIncidentInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IncidentView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Open a status page incident by hand (operator)",
        "tags": [
          "status"
        ]
      }
    },
    "/operator/status/incidents/{id}": {
      "patch": {
        "description": "The operator organization with `alerts.manage`. A state change needs a note; `resolved` sets the resolution time. Automatic incidents can be annotated too (the probes still resolve them). Audited `status.incident_updated`.",
        "operationId": "updateStatusIncident",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchIncidentInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IncidentView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change an incident or add a public note (operator)",
        "tags": [
          "status"
        ]
      }
    },
    "/operator/tenants/{slug}/backup-addons": {
      "get": {
        "description": "Admins of the operator tenant with `tenant.manage`.",
        "operationId": "listBackupAddons",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "maxLength": 63,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupAddonListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "An organization's backup storage add-ons (operator)",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "Standard or Premium, +100/+250/+500/+1000 GB. Manual until M31 billing. Audited. Requires `X-CSRF-Token`.",
        "operationId": "addBackupAddon",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "maxLength": 63,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AddBackupAddonInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupAddonListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Assign a backup storage add-on (operator)",
        "tags": [
          "backups"
        ]
      }
    },
    "/operator/tenants/{slug}/backup-addons/{id}": {
      "delete": {
        "description": "Audited. Requires `X-CSRF-Token`.",
        "operationId": "removeBackupAddon",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "maxLength": 63,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupAddonListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a backup storage add-on (operator)",
        "tags": [
          "backups"
        ]
      }
    },
    "/operator/tenants/{slug}/edition": {
      "put": {
        "description": "Admins of the operator tenant (`PLUSPANEL_OPERATOR_TENANT`) with `tenant.manage`. A downgrade removes nothing; resources above the new limits stay and new ones are refused. Audited `tenant.edition`. M31 billing calls the same code.",
        "operationId": "setTenantEdition",
        "parameters": [
          {
            "in": "path",
            "name": "slug",
            "required": true,
            "schema": {
              "maxLength": 63,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetEditionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EditionView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set an organization's edition (operator)",
        "tags": [
          "operator"
        ]
      }
    },
    "/php-versions": {
      "get": {
        "operationId": "listPHPVersions",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PHPVersionListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the PHP versions and their lifecycle (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/plans": {
      "get": {
        "description": "Requires `plans.read` (admins and resellers).",
        "operationId": "listPlans",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "include_archived",
            "schema": {
              "type": "boolean"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the organization's hosting plans",
        "tags": [
          "plans"
        ]
      },
      "post": {
        "description": "Requires `plans.manage`. Names are unique per organization (case-insensitive). Audited `plan.create`.",
        "operationId": "createPlan",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PlanInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a hosting plan (admin)",
        "tags": [
          "plans"
        ]
      }
    },
    "/plans/{id}": {
      "get": {
        "operationId": "getPlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a hosting plan",
        "tags": [
          "plans"
        ]
      },
      "put": {
        "description": "Requires `plans.manage`. Every active account on the plan whose effective limits change gets `update_account_quota` and/or `ensure_account_runtime`; busy or inactive accounts are listed in `pending`. 409 `quota_below_usage` when an account's last reported usage is above the new quota, 409 `reseller_limit_exceeded` when a reseller's allocations would exceed its limits. Audited `plan.update`.",
        "operationId": "updatePlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdatePlanInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanUpdateOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace a plan's limits and converge its accounts (admin)",
        "tags": [
          "plans"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/plans/{id}/archive": {
      "post": {
        "description": "Archived plans keep their accounts but take no new ones. The default plan cannot be archived (409). Audited.",
        "operationId": "archivePlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ArchivePlanInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Archive or restore a plan (admin)",
        "tags": [
          "plans"
        ]
      }
    },
    "/plans/{id}/default": {
      "post": {
        "description": "Accounts created without `plan_id` get the default plan. Audited `plan.update`.",
        "operationId": "setDefaultPlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlanView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Make a plan the default (admin)",
        "tags": [
          "plans"
        ]
      }
    },
    "/plugin-sets": {
      "get": {
        "operationId": "listPluginSets",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PluginSetListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the tenant's plugin sets (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/readyz": {
      "get": {
        "operationId": "readyz",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Readiness: dependencies (database) are reachable",
        "tags": [
          "health"
        ]
      }
    },
    "/security/overview": {
      "get": {
        "description": "`security.manage`.",
        "operationId": "getSecurityOverview",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecurityOverviewOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Fleet security overview: servers, WAF modes, recent blocks (admin)",
        "tags": [
          "security"
        ]
      }
    },
    "/security/waf-defaults": {
      "get": {
        "description": "`security.manage`.",
        "operationId": "getWAFDefaults",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WAFDefaultsBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get the fleet WAF default for new sites (admin)",
        "tags": [
          "security"
        ]
      },
      "put": {
        "description": "Existing sites keep their mode (use PUT /accounts/{id}/waf or the site policy). `security.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "putWAFDefaults",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/WAFDefaultsBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WAFDefaultsBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the fleet WAF default for new sites (admin)",
        "tags": [
          "security"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers": {
      "get": {
        "operationId": "listServers",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageServerView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List servers in the caller's tenant",
        "tags": [
          "servers"
        ]
      },
      "post": {
        "description": "Requires the `X-CSRF-Token` header. The enrollment ceremony itself arrives in M05.",
        "operationId": "createServer",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateServerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreateServerOutputBody"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a pending server record",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}": {
      "get": {
        "description": "`ingress` is the host ingress as the agent's heartbeat last reported it (M10), null until reported. `acme` is the TLS engine's ACME settings (M11), null while the agent reports none.",
        "operationId": "getServer",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDetailView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a server with its live state",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}/accounts": {
      "get": {
        "operationId": "listAccounts",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Also list accounts whose data was purged.",
            "explode": false,
            "in": "query",
            "name": "include_purged",
            "schema": {
              "description": "Also list accounts whose data was purged.",
              "type": "boolean"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAccountView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List accounts of a server with live usage (admin)",
        "tags": [
          "accounts"
        ]
      },
      "post": {
        "description": "Creates the account (pending), enqueues `provision_account_storage` and returns it in status `provisioning`. The account becomes `active` when the agent reports success, or goes back to `pending` with `last_error` on failure (e.g. `storage_not_ready` before `POST /servers/{id}/storage/init`). Requires `X-CSRF-Token`.",
        "operationId": "createAccount",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateAccountInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create an account and provision its storage (admin)",
        "tags": [
          "accounts"
        ]
      }
    },
    "/servers/{id}/accounts/{account_id}": {
      "delete": {
        "description": "Two-step delete (agent ADR-0001 §6). Requires `X-CSRF-Token`.\n\n1. `DELETE` without `confirm_token`: returns 202 `{confirm_token, expires_at}` and changes nothing. The token (`ppd1_…`) is random, single-use, valid 10 minutes, stored only as a SHA-256 hash, and supersedes earlier unused tokens of the account.\n2. `DELETE ?confirm_token=\u003ctoken\u003e`: returns 202 `{account}` with status `removing` and enqueues `remove_account_storage`, which moves the volume into quarantine on the server (nothing is deleted until `POST /servers/{id}/storage/purge`). When the account has a container runtime (M08-core), `remove_account_runtime` is enqueued instead and `remove_account_storage` follows when it succeeds (on failure the account returns to `active` with the error).\n\nServices must be removed first: both steps answer 409 `account_has_services` while the account has services that are not removed, and 409 `conflict` while a runtime job of the account is running.\n\nErrors: 422 `confirm_token_invalid` (malformed, unknown, superseded or for another account), 409 `confirm_token_expired`, 409 `confirm_token_used`, 409 `conflict` (account not active/pending, or another operation of the account is still running).\n\nThe platform then derives the agent confirm token `RemoveAccountStorage.confirm_token = \"rm1-\" + first 32 hex chars of SHA-256(\"pluspanel.v1.RemoveAccountStorage\\x00\" + server_id + \"\\x00\" + account_id)` (lower-case UUID strings). Test vector (shared with pluspanel-agent): server_id `0854f6cd-c4ab-4857-a5eb-48350deee5c0`, account_id `11111111-2222-4333-8444-555555555555` → `rm1-1875f5e80d96f121fd5495e37f1afe1f`.",
        "operationId": "deleteAccount",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Token from the first DELETE. Absent: issue a token only.",
            "explode": false,
            "in": "query",
            "name": "confirm_token",
            "schema": {
              "description": "Token from the first DELETE. Absent: issue a token only.",
              "maxLength": 64,
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeleteAccountOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete an account in two steps (admin)",
        "tags": [
          "accounts"
        ]
      },
      "get": {
        "operationId": "getAccount",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get an account with usage and allocation (admin)",
        "tags": [
          "accounts"
        ]
      },
      "patch": {
        "description": "Quota: enqueues `update_account_quota`; `quota_bytes`/`inode_limit` keep their old values until the agent confirms, a failure is exposed in `last_error`, and no other storage operation of the account may be running.\n\nResource limits (M08-core): `cpu_millicores`/`memory_bytes` are stored right away; when the account's runtime was ever ensured (`runtime.status` not null) `ensure_account_runtime` is enqueued so the agent applies them to every container of the account (the applied values appear in `runtime.applied_*`). Otherwise the first deploy applies them. 409 while the runtime is being removed.\n\nOnly `active` accounts. Requires `X-CSRF-Token`.",
        "operationId": "updateAccount",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateAccountInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change an account's quota or resource limits (admin)",
        "tags": [
          "accounts"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers/{id}/accounts/{account_id}/runtime": {
      "delete": {
        "description": "Enqueues `remove_account_runtime`: the agent stops and deletes every container and the network of the account. On success `runtime.status` becomes `none` and every service of the account `removed`; on failure `failed` with the error. The account's volume is not touched (deleting the account's data is the separate two-step account DELETE). 409 when the account is not active, a runtime job is still running, or a service operation is in flight. Requires `X-CSRF-Token`.",
        "operationId": "removeAccountRuntime",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove an account's container runtime and all its services (admin)",
        "tags": [
          "services"
        ]
      },
      "post": {
        "description": "Enqueues `ensure_account_runtime` with the account's current `cpu_millicores`/`memory_bytes` and returns the account with `runtime.status` `ensuring`; it becomes `ready` (with `runtime.address`/`subnet`) or `failed` (with `runtime.last_error_code`) when the agent reports. Deploys do this on their own when needed. 409 when the account is not active or a runtime job of the account is still running. Requires `X-CSRF-Token`.",
        "operationId": "ensureAccountRuntime",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccountView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create or converge an account's container runtime (admin)",
        "tags": [
          "services"
        ]
      }
    },
    "/servers/{id}/accounts/{account_id}/services": {
      "get": {
        "operationId": "listServices",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Also list removed services.",
            "explode": false,
            "in": "query",
            "name": "include_removed",
            "schema": {
              "description": "Also list removed services.",
              "type": "boolean"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List the services of an account with live status (admin)",
        "tags": [
          "services"
        ]
      },
      "post": {
        "description": "Resolves the catalog image's `stable` tag to a manifest digest from the platform registry (server-side, at deploy time), stores the service (`deploying`) and enqueues `deploy_app_container` with the digest. When the account's runtime is not ready yet, `ensure_account_runtime` (with the account's CPU/memory limits) is enqueued first and the deploy follows when it succeeds; if it fails, the service becomes `failed` with the runtime error. The service becomes `running` when the agent reports success; live state, health, restarts and the published host address come from heartbeats (`live`).\n\nErrors: 409 `conflict` (duplicate name, account not active, revoked server), 422 validation, 503 `catalog_unavailable` (the digest could not be resolved; nothing was stored). Requires `X-CSRF-Token`.",
        "operationId": "deployService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeployServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Deploy a catalog image into an account (admin)",
        "tags": [
          "services"
        ]
      }
    },
    "/servers/{id}/accounts/{account_id}/services/{name}": {
      "delete": {
        "description": "Enqueues `remove_app_container`; the service is `removing` until the agent confirms, then `removed` (also when the agent no longer has it: `runtime_service_not_found`). A deploy still waiting for the account runtime is removed at once. The account's data is not touched. Removed services are listed only with `include_removed=true`. Requires `X-CSRF-Token`.",
        "operationId": "removeService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "maxLength": 31,
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a service (admin)",
        "tags": [
          "services"
        ]
      },
      "get": {
        "operationId": "getService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "maxLength": 31,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a service with live status (admin)",
        "tags": [
          "services"
        ]
      }
    },
    "/servers/{id}/accounts/{account_id}/services/{name}/restart": {
      "post": {
        "description": "Enqueues `restart_app_container`; the service is `restarting` until the agent reports the result (`running`, or `failed` with the error). Only `running` or `failed` services with no operation in flight. Requires `X-CSRF-Token`.",
        "operationId": "restartService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "account_id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "maxLength": 31,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Restart a service (admin)",
        "tags": [
          "services"
        ]
      }
    },
    "/servers/{id}/addresses": {
      "patch": {
        "description": "The targets of the site record template (PATCH /sites/{id}/domains with `manage_dns`) and of zone templates with `server_id`. Needs `servers.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setServerAddresses",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetServerAddressesInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a server's public addresses (admin)",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}/backup-test-hooks": {
      "put": {
        "description": "Enqueues `set_backup_test_hooks`. Setting needs a lab server and `jobs.test_probes`; clearing (0) is allowed anywhere. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setServerBackupTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupJobOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the backup drill hook of a lab server (admin)",
        "tags": [
          "backups"
        ]
      }
    },
    "/servers/{id}/bans": {
      "get": {
        "description": "`security.manage`.",
        "operationId": "listServerBans",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BanListOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a server's active brute-force bans (admin)",
        "tags": [
          "security"
        ]
      }
    },
    "/servers/{id}/bans/{address}": {
      "delete": {
        "description": "Enqueues `unban_address`. IPv6 bans cover a /64: any address inside it, its network address or `network/64` (URL-encoded) lift it. 422 for an invalid address, 409 `security_unsupported_agent`. `security.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "unbanAddress",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "The banned IPv4 or IPv6 address.",
            "in": "path",
            "name": "address",
            "required": true,
            "schema": {
              "description": "The banned IPv4 or IPv6 address.",
              "maxLength": 64,
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobIDOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Lift a brute-force ban (admin)",
        "tags": [
          "security"
        ]
      }
    },
    "/servers/{id}/db-test-hooks": {
      "put": {
        "description": "Enqueues `set_db_test_hooks`. Setting a hook needs a lab server and `jobs.test_probes` (403); clearing (0) is allowed anywhere. Audited.",
        "operationId": "setServerDBTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DBTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReloadIngressOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the database drill hooks of a lab server (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/servers/{id}/enrollment-token": {
      "post": {
        "description": "The token is returned once and replaces any unused token of the server. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createEnrollmentToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnrollmentTokenOutputBody"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a one-time enrollment token for a server (admin)",
        "tags": [
          "servers"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/servers/{id}/exit-reports": {
      "get": {
        "description": "Reports of the OS hook pluspanel-agent-exit-watch, newest first, without the journal. `observability.read` at tenant scope.",
        "operationId": "listServerExitReports",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageExitReportView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A server's unexpected agent exits",
        "tags": [
          "observability"
        ]
      }
    },
    "/servers/{id}/exit-reports/{rid}": {
      "get": {
        "description": "`observability.read` at tenant scope.",
        "operationId": "getServerExitReport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "rid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExitReportView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "One unexpected agent exit with its journal",
        "tags": [
          "observability"
        ]
      }
    },
    "/servers/{id}/firewall": {
      "get": {
        "description": "As the agent last reported it (`supported` false: never). `security.manage`.",
        "operationId": "getServerFirewall",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/FirewallView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "What a server's firewall lets in: listening sockets, exposure, no inbound management (admin)",
        "tags": [
          "security"
        ]
      }
    },
    "/servers/{id}/ingress/reload": {
      "post": {
        "description": "Resolves the `ingress` image digest (409 `ingress_unavailable` when it cannot be resolved) and enqueues `reload_ingress`: the agent ensures the container and its firewall rule (restarting the container first with `restart: true`), re-renders the configuration from its site records and reloads it. Idempotent. Audited. Requires `X-CSRF-Token`.",
        "operationId": "reloadServerIngress",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReloadIngressInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReloadIngressOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Ensure and reload the host ingress of a server (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/servers/{id}/jobs": {
      "get": {
        "operationId": "listServerJobs",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Only jobs in this status.",
            "explode": false,
            "in": "query",
            "name": "status",
            "schema": {
              "description": "Only jobs in this status.",
              "enum": [
                "pending",
                "leased",
                "dispatched",
                "acked",
                "succeeded",
                "failed",
                "dead",
                "cancelled"
              ],
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageJobView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List jobs of a server, newest first",
        "tags": [
          "jobs"
        ]
      },
      "post": {
        "description": "Requires the `X-CSRF-Token` header. The job is delivered when the server's agent is connected.",
        "operationId": "enqueueJob",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/EnqueueJobInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Enqueue a typed command for a server (admin)",
        "tags": [
          "jobs"
        ]
      }
    },
    "/servers/{id}/lab": {
      "put": {
        "description": "Requires the `X-CSRF-Token` header. Only lab servers accept the destructive drill probes.",
        "operationId": "setServerLab",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetServerLabInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Mark or unmark a lab server (admin only, audited)",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}/mail": {
      "get": {
        "operationId": "getServerMail",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailServerView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Mail service of a server (admin)",
        "tags": [
          "mail"
        ]
      },
      "put": {
        "description": "Enables or disables mox on the server (ADR-0017) with its mail host name and outgoing mode: `platform` (the platform relay, per-server credential derived on demand), `custom` (an own smarthost; its password goes to the organization's vault and is sealed to the server's key per job), `direct` (the server delivers to MX itself) or `none`. Enqueues `set_mail_server` with the catalog's mox digest and the organization's branding. 409 `mail_agent_unsupported` before the agent reports a mail engine. Audited `mail.server`.",
        "operationId": "setServerMail",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetMailServerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MailServerActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Configure the mail service of a server (admin)",
        "tags": [
          "mail"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers/{id}/mail/queue": {
      "post": {
        "description": "Enqueues `mail_queue` (list, retry, fail, hold, release); the answer is the job: its output lists the queue (`GET /jobs/{id}`). Actions other than list are audited.",
        "operationId": "mailQueue",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MailQueueInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobAcceptedBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List or act on the outgoing queue (admin)",
        "tags": [
          "mail"
        ]
      }
    },
    "/servers/{id}/maintenance-window": {
      "delete": {
        "operationId": "deleteServerMaintenanceWindow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a server's own maintenance window (admin)",
        "tags": [
          "updates"
        ]
      },
      "get": {
        "operationId": "getServerMaintenanceWindow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerWindowOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A server's maintenance window (admin)",
        "tags": [
          "updates"
        ]
      },
      "put": {
        "operationId": "setServerMaintenanceWindow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/WindowBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerWindowOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a server's own maintenance window (admin)",
        "tags": [
          "updates"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers/{id}/observability": {
      "get": {
        "description": "Any panel of the closed set, server-wide. `observability.read` at tenant scope. Source `central` when the organization's central stores hold the panel within its retention, otherwise `local` (a signed query to the server's agent: 409 `telemetry_unsupported_agent`, 503 `agent_offline`, 504 `telemetry_query_timeout`).",
        "operationId": "getServerObservability",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Panel of the closed set (ADR-0014 §9).",
            "explode": false,
            "in": "query",
            "name": "panel",
            "required": true,
            "schema": {
              "description": "Panel of the closed set (ADR-0014 §9).",
              "enum": [
                "cpu",
                "memory",
                "load",
                "disk",
                "inodes",
                "disk_io",
                "network",
                "requests",
                "errors",
                "account_cpu",
                "account_memory",
                "account_storage",
                "account_io",
                "account_network",
                "containers"
              ],
              "type": "string"
            }
          },
          {
            "description": "Range start (RFC 3339); default one hour before to.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Range start (RFC 3339); default one hour before to.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Range end (RFC 3339); default now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Range end (RFC 3339); default now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
            "explode": false,
            "in": "query",
            "name": "step",
            "schema": {
              "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
              "format": "int64",
              "maximum": 86400,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A server panel",
        "tags": [
          "observability"
        ]
      }
    },
    "/servers/{id}/revoke": {
      "post": {
        "operationId": "revokeServer",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokeOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Revoke a server: deny-list its certificates and drop its connection (admin)",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}/security": {
      "get": {
        "description": "`security.manage`.",
        "operationId": "getServerSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerSecurityView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a server's firewall rules, country rule and brute-force policy (admin)",
        "tags": [
          "security"
        ]
      },
      "put": {
        "description": "Replaces the policy and pushes `set_server_security` (countries first with `put_geo_country`, only those used on the server). 409 `security_unsupported_agent`, 409 `geoip_unavailable`, 422 for invalid rules (CIDRs must be canonical). `security.manage`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "putServerSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServerPolicyBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerSecurityView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a server's firewall rules, country rule and brute-force policy (admin)",
        "tags": [
          "security"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers/{id}/sftp": {
      "get": {
        "operationId": "getServerSftp",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SftpStatusView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "SFTP service of a server (admin)",
        "tags": [
          "sftp"
        ]
      },
      "put": {
        "description": "SFTP is OFF on every server until an admin enables it here (agent ADR-0008 §2): enabling starts apps/sftpgo and opens port 2222 to the internet (the customer data plane); no account gets an SFTP user unless one is created explicitly. Disabling stops the service and closes the port; users are kept. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setServerSftp",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetServerSftpInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SetServerSftpOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Enable or disable the SFTP service of a server (admin)",
        "tags": [
          "sftp"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/servers/{id}/storage": {
      "get": {
        "operationId": "getServerStorage",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerStorageOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Server storage status and readiness (admin)",
        "tags": [
          "storage"
        ]
      }
    },
    "/servers/{id}/storage/init": {
      "post": {
        "description": "Enqueues `storage_init` and returns the job. The outcome (READY, NEEDS_REBOOT, NEEDS_ACTION) appears in `GET /servers/{id}/storage` with the next heartbeat. The agent reboots only with `allow_reboot: true`. Requires `X-CSRF-Token`.",
        "operationId": "storageInit",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StorageInitInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Initialise server storage (project quotas) (admin)",
        "tags": [
          "storage"
        ]
      }
    },
    "/servers/{id}/storage/purge": {
      "post": {
        "description": "Enqueues `purge_quarantine`: the only real deletion. On success the covered accounts get `purged_at` (by the agent's `purged_account_ids` output when present, otherwise every quarantined account quarantined at least `older_than_seconds` before the job was created). Requires `X-CSRF-Token`.",
        "operationId": "storagePurge",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StoragePurgeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Purge quarantined account volumes (admin)",
        "tags": [
          "storage"
        ]
      }
    },
    "/servers/{id}/telemetry-test-hooks": {
      "put": {
        "description": "Enqueues `obs_test_probe`: exactly one of fill_host_disk_bytes, release_host_disk, kill_agent, stop_container. A fill, a kill or a stop needs a lab server and `jobs.test_probes`; a release is allowed anywhere (with `jobs.manage`). Audited. Requires `X-CSRF-Token`.",
        "operationId": "setServerTelemetryTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TelemetryTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobIDOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Run an M21 drill probe on a lab server",
        "tags": [
          "observability"
        ]
      }
    },
    "/servers/{id}/terminal-test-hooks": {
      "put": {
        "description": "Enqueues `set_terminal_test_hooks` (a short idle timeout for drills). Setting it needs a lab server and `jobs.test_probes` (403); clearing (0) is allowed anywhere. Audited.",
        "operationId": "setServerTerminalTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TerminalTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobAcceptedBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the web terminal drill hook of a lab server (admin)",
        "tags": [
          "terminal"
        ]
      }
    },
    "/servers/{id}/tls/test-hooks": {
      "put": {
        "description": "Lab only: needs `sites.manage` and the explicit permission `jobs.test_probes`, and, to set any hook, a lab server (PUT /servers/{id}/lab); 403 otherwise. All zero/false clears the hooks (allowed on any server). Enqueues `set_tls_test_hooks`. 409 `tls_unsupported_agent` when the agent has no TLS engine, 422 for out-of-range values. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setServerTLSTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetTLSTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobAcceptedOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the TLS engine's drill hooks of a lab server (admin)",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{id}/update-channel": {
      "put": {
        "description": "A different channel enqueues the signed job `set_update_channel`; `servers.channel` changes when it succeeds. 409 `channel_unsupported_agent` for agents without the capability. A server that changes channel leaves an active rollout (skipped: channel_changed).",
        "operationId": "setServerUpdateChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateChannelInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpdateChannelOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a server's release channel (admin)",
        "tags": [
          "updates"
        ]
      }
    },
    "/servers/{id}/update-ring": {
      "put": {
        "operationId": "setServerUpdateRing",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateRingInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Put a server in the internal ring (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/servers/{id}/update-test-hooks": {
      "put": {
        "description": "Operator organization, a lab server and the explicit permission jobs.test_probes. Moves the confirmed/passed times of the server's passed targets of finished rollouts backdate_days into the past so the 7-day cleanup becomes due.",
        "operationId": "setServerUpdateTestHooks",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateTestHooksInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpdateTestHooksOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Lab hook: backdate a server's update confirmations (drills)",
        "tags": [
          "updates"
        ]
      }
    },
    "/servers/{id}/updates": {
      "get": {
        "operationId": "getServerUpdates",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerUpdatesView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A server's update state and history (admin)",
        "tags": [
          "updates"
        ]
      }
    },
    "/sites/{id}": {
      "delete": {
        "description": "Step two: with the `confirm_token` of `POST /sites/{id}/removal-token` sets the site `removing` and enqueues `remove_wordpress_site`. The agent stops both containers and quarantines the database; the row is deleted when the job succeeds (the audit trail remains). A wrong token is refused (409 `confirm_token_mismatch`) and audited. Requires `X-CSRF-Token`.",
        "operationId": "removeSite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "From POST /sites/{id}/removal-token; anything else is refused (409) and audited.",
            "explode": false,
            "in": "query",
            "name": "confirm_token",
            "schema": {
              "description": "From POST /sites/{id}/removal-token; anything else is refused (409) and audited.",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a WordPress site (admin)",
        "tags": [
          "sites"
        ]
      },
      "get": {
        "operationId": "getSite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteDetailOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a WordPress site with live status, snapshots and recent jobs (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/backup-rollback": {
      "post": {
        "description": "`backups.restore`. Restores the site in place from `snapshot_id` or its newest pre-update snapshot (taken automatically before WordPress updates). Audited. Requires `X-CSRF-Token`.",
        "operationId": "rollbackSiteBackup",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SiteRollbackInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupRestoreView"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Roll a site back to a backup snapshot (one click)",
        "tags": [
          "backups"
        ]
      }
    },
    "/sites/{id}/db-bindings": {
      "get": {
        "operationId": "listSiteDBBindings",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteBindingsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a site's database bindings (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/sites/{id}/db-bindings/{prefix}": {
      "delete": {
        "operationId": "unbindSiteDB",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "prefix",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteBindingOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a database binding from a site (admin)",
        "tags": [
          "databases"
        ]
      },
      "put": {
        "description": "Enqueues `bind_database_to_site`: the site's web container gets \u003cprefix\u003e_HOST, _PORT, _NAME, _USER, _PASSWORD and _URL and starts after the service. Same account only; at most 4 bindings per site. Audited.",
        "operationId": "bindSiteDB",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "prefix",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SiteBindingInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteBindingOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Bind a database service to a site (admin)",
        "tags": [
          "databases"
        ]
      }
    },
    "/sites/{id}/domains": {
      "patch": {
        "description": "Normalizes and validates every host name (422), reserves them on the server (409 `domain_taken` names a host another site uses) and enqueues `set_site_domains`: the agent re-renders the ingress, reloads it and, when the primary changed, updates WordPress `siteurl`/`home`. The desired names are part of the site at once; `live.domains` shows what the ingress routes. A failed job keeps its error in `domains_error`. One mutating job per site (409). 409 `ingress_unavailable` when the ingress image cannot be resolved. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setSiteDomains",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetSiteDomainsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a site's primary domain and aliases (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/observability": {
      "get": {
        "description": "requests and errors of the site; 422 `panel_not_available` otherwise. `observability.read` (resellers and clients: their sites). Source `central` when the organization's central stores hold the panel within its retention, otherwise `local` (a signed query to the server's agent: 409 `telemetry_unsupported_agent`, 503 `agent_offline`, 504 `telemetry_query_timeout`).",
        "operationId": "getSiteObservability",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Panel of the closed set (ADR-0014 §9).",
            "explode": false,
            "in": "query",
            "name": "panel",
            "required": true,
            "schema": {
              "description": "Panel of the closed set (ADR-0014 §9).",
              "enum": [
                "cpu",
                "memory",
                "load",
                "disk",
                "inodes",
                "disk_io",
                "network",
                "requests",
                "errors",
                "account_cpu",
                "account_memory",
                "account_storage",
                "account_io",
                "account_network",
                "containers"
              ],
              "type": "string"
            }
          },
          {
            "description": "Range start (RFC 3339); default one hour before to.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Range start (RFC 3339); default one hour before to.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Range end (RFC 3339); default now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Range end (RFC 3339); default now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
            "explode": false,
            "in": "query",
            "name": "step",
            "schema": {
              "description": "Seconds between points (15..86400; 0 = automatic, about 240 points).",
              "format": "int64",
              "maximum": 86400,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A site panel",
        "tags": [
          "observability"
        ]
      }
    },
    "/sites/{id}/php-version": {
      "patch": {
        "description": "Enqueues `set_site_php_version`: the agent snapshots the site first, redeploys the web container on the version's php-ols image and runs the health check; on failure it redeploys the previous image automatically (`php_error` shows `wp_php_switch_failed`, `php_version` stays). `php_version` changes when the job succeeds. 422 for a version that is unknown or disabled, 409 when the site already runs it or is busy, 503 `catalog_unavailable`. `force_health_failure` needs a lab server and `jobs.test_probes` (403). Audited. Requires `X-CSRF-Token`.",
        "operationId": "setSitePHPVersion",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetSitePHPVersionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Switch a site's PHP version (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/removal-token": {
      "post": {
        "description": "Step one of the two-step removal: returns `rw1-` + the first 32 hex digits of SHA-256(`pluspanel.v1.RemoveWordPressSite` NUL server_id NUL site_id). Audited. Requires `X-CSRF-Token`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createSiteRemovalToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RemovalTokenOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "$ref": "#/components/responses/IdempotencyConflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get the confirmation token of a site removal (admin)",
        "tags": [
          "sites"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/sites/{id}/rollback": {
      "post": {
        "description": "Enqueues `rollback_site` for one of the site's mirrored snapshots (404 otherwise). Requires `X-CSRF-Token`.",
        "operationId": "rollbackSite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RollbackSiteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Roll a site back to a snapshot (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/security": {
      "get": {
        "description": "Needs `security.waf` (resellers and clients for the sites of their accounts). `applied` is what the agent runs; `in_sync` compares its policy hash with the desired one.",
        "operationId": "getSiteSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteSecurityView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a site's WAF, security headers and country rule",
        "tags": [
          "security"
        ]
      },
      "put": {
        "description": "Replaces the policy (exclusions stay) and pushes `set_site_security` at once when the agent runs another one (`pending_job_id`). 409 `security_unsupported_agent` for an agent without a security engine, 409 `geoip_unavailable` for a country rule without a GeoIP database, 422 `csp_invalid`, 422 for other invalid values. `security.waf`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "putSiteSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SitePolicyBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteSecurityView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a site's WAF, security headers and country rule",
        "tags": [
          "security"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/sites/{id}/snapshots": {
      "post": {
        "description": "Enqueues `snapshot_site` (the agent keeps the newest five inside the account's quota). Requires `X-CSRF-Token`.",
        "operationId": "snapshotSite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SnapshotSiteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Snapshot a site's files and database (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/tls": {
      "patch": {
        "description": "Enqueues `set_site_tls_policy`. `auto`: the agent obtains a Let's Encrypt certificate for the primary domain and every alias (HTTP-01) and redirects HTTP to HTTPS once it is served; `acme_production` picks the endpoint (staging certificates are not trusted by browsers; production is rate limited). `off`: HTTPS is refused for the site's names and its certificate is removed. `tls.mode` changes when the job succeeds; a failure is kept in `tls.error`. 422 `tls_use_import` for `custom`; 409 when the site is busy or not active/broken; 409 `tls_unsupported_agent` when the server's agent has no TLS engine. Audited. Requires `X-CSRF-Token`.",
        "operationId": "setSiteTLS",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetSiteTLSInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a site's TLS policy (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/tls/import": {
      "post": {
        "description": "Validates the certificate, key and chain (422 with one of `cert_invalid_pem`, `cert_too_large`, `cert_key_unsupported`, `cert_key_mismatch`, `cert_expired`, `cert_not_yet_valid`, `cert_usage_invalid`, `cert_chain_invalid`, `cert_name_mismatch`: the leaf must cover the primary domain) and enqueues `import_site_certificate`; the mode becomes `custom` when the job succeeds and the agent never renews it. The private key travels once inside the signed job: it is never logged or audited, no API returns it, and it is removed from the stored job when the job ends. Body at most 160 KiB (413). 409 as for PATCH /sites/{id}/tls. Audited (fingerprint, issuer, names, expiry). Requires `X-CSRF-Token`.",
        "operationId": "importSiteCertificate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ImportSiteCertificateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "413": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Request Entity Too Large"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Import a certificate for a site (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/tls/renew": {
      "post": {
        "description": "Enqueues `renew_site_certificate`: the agent renews when the certificate is due (expiring, names changed, none yet) or, with `force`, unconditionally. 409 `tls_not_auto` unless the site's mode is auto; 409 as for PATCH /sites/{id}/tls. Audited. Requires `X-CSRF-Token`.",
        "operationId": "renewSiteCertificate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenewSiteCertificateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Renew a site's ACME certificate (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/sites/{id}/waf-events": {
      "get": {
        "description": "`security.waf_log`.",
        "operationId": "listSiteWAFEvents",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Only blocked or only detected (logged) requests.",
            "explode": false,
            "in": "query",
            "name": "outcome",
            "schema": {
              "description": "Only blocked or only detected (logged) requests.",
              "enum": [
                "blocked",
                "detected"
              ],
              "type": "string"
            }
          },
          {
            "description": "Events at or after this time.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Events at or after this time.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Events before this time.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Events before this time.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWAFEventView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a site's WAF events (newest first, 30 days)",
        "tags": [
          "security"
        ]
      }
    },
    "/sites/{id}/waf-exclusions": {
      "post": {
        "description": "At most 100 per site (422); the same rule and path twice is 409. The initialization and anomaly-scoring rules 901000-901999, 949000-949999, 959000-959999 and 980000-980999 are refused (422 `waf_exclusion_protected_rule`): excluding one would disable blocking. A path prefix with /./, /../, // or a trailing /.. is refused (422). `security.waf`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "addWAFExclusion",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AddWAFExclusionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteSecurityView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Exclude a CRS rule for a site",
        "tags": [
          "security"
        ]
      }
    },
    "/sites/{id}/waf-exclusions/{eid}": {
      "delete": {
        "description": "`security.waf`. Audited. Requires `X-CSRF-Token`.",
        "operationId": "deleteWAFExclusion",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "eid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteSecurityView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove a CRS rule exclusion",
        "tags": [
          "security"
        ]
      }
    },
    "/sites/{id}/wp-cli": {
      "post": {
        "description": "Requires `sites.manage` and `jobs.manage`. Enqueues `run_wp_cli_operation`; the operation is one of the closed allowlist (see `operation`), every argument is validated, and unused arguments must be empty. A refused attempt is audited (`site.wpcli_rejected`). One mutating job per site at a time (409). The result (`exit_code`, `stdout`) is in the job; USER_CREATE / USER_PASSWORD_RESET return their password once through `GET /jobs/{id}/sensitive`. Requires `X-CSRF-Token`.",
        "operationId": "runSiteWpCli",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/WpCliInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SiteActionOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Run an allowlisted WP-CLI operation on a site (admin)",
        "tags": [
          "sites"
        ]
      }
    },
    "/status": {
      "get": {
        "description": "The document of status.pluspanel.net: components (control_plane, mesh, relay, dns, registry) with their state and 14 days of daily uptime, and the incidents of the last 14 days. No internal detail. Cacheable 15 s.",
        "operationId": "getStatus",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StatusDoc"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Public platform status (no authentication)",
        "tags": [
          "status"
        ]
      }
    },
    "/tenant/branding": {
      "delete": {
        "operationId": "clearTenantBranding",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the branding, logo included (admin)",
        "tags": [
          "tenant"
        ]
      },
      "get": {
        "operationId": "getTenantBranding",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's white-label branding (admin)",
        "tags": [
          "tenant"
        ]
      },
      "put": {
        "description": "Requires `tenant.manage`. Product name, colors (the primary color must keep white text at 4.5:1), terminology overrides and the support contact; the logo is set with `PUT /tenant/branding/logo`. Audited `tenant.branding`.",
        "operationId": "setTenantBranding",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetBrandingInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Replace the white-label branding (admin)",
        "tags": [
          "tenant"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/tenant/branding/logo": {
      "delete": {
        "operationId": "clearTenantLogo",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the logo (admin)",
        "tags": [
          "tenant"
        ]
      },
      "put": {
        "description": "PNG or JPEG only (no SVG), at most 128 KiB and 1024×1024; decoded before it is stored. Audited.",
        "operationId": "setTenantLogo",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetLogoInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BrandingView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Upload the logo (admin)",
        "tags": [
          "tenant"
        ]
      }
    },
    "/tenant/edition": {
      "get": {
        "operationId": "getTenantEdition",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EditionView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's edition, what it includes and what is used",
        "tags": [
          "tenant"
        ]
      }
    },
    "/tenant/maintenance-window": {
      "delete": {
        "operationId": "deleteTenantMaintenanceWindow",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the organization's maintenance window (admin)",
        "tags": [
          "updates"
        ]
      },
      "get": {
        "operationId": "getTenantMaintenanceWindow",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WindowOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's maintenance window (admin)",
        "tags": [
          "updates"
        ]
      },
      "put": {
        "operationId": "setTenantMaintenanceWindow",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/WindowBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WindowOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the organization's maintenance window (admin)",
        "tags": [
          "updates"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/tenant/panel-host": {
      "delete": {
        "description": "Audited `tenant.panel_host`. Records created with manage_dns stay (they are plain zone records).",
        "operationId": "clearPanelHost",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelHostView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Remove the white-label panel host (admin)",
        "tags": [
          "tenant"
        ]
      },
      "get": {
        "description": "Requires `tenant.manage`. DNS: what the host resolves to, whether it points at the panel, and the records to create (in the organization's own zone when it is hosted here, M12). TLS: the certificate the edge serves.",
        "operationId": "getPanelHost",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelHostView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The white-label panel host with its DNS and TLS state (admin)",
        "tags": [
          "tenant"
        ]
      },
      "put": {
        "description": "Requires `tenant.manage`. The host must be a valid DNS name (IDNA, no wildcard, no IP), not under PlusPanel's own domains (422 `panel_host_reserved`) and not another organization's (409 `panel_host_taken`). A login on the host resolves this organization; the edge obtains its certificate on demand. Audited `tenant.panel_host`.",
        "operationId": "setPanelHost",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetPanelHostInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelHostView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the white-label panel host (admin)",
        "tags": [
          "tenant"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/tenant/security-policy": {
      "get": {
        "description": "Requires `security.policy`. The operator organization always requires MFA for everyone (`mfa_forced`).",
        "operationId": "getSecurityPolicy",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecurityPolicyView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's 2FA and password policy",
        "tags": [
          "security"
        ]
      },
      "put": {
        "description": "Requires `security.policy`. Users who must use MFA and have no factor get a session limited to enrolling one at their next sign-in. Audited `security.policy_updated`.",
        "operationId": "setSecurityPolicy",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetSecurityPolicyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecurityPolicyView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set the organization's 2FA and password policy",
        "tags": [
          "security"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/tenant/update-settings": {
      "get": {
        "operationId": "getTenantUpdateSettings",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpdateSettingsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The organization's update settings (admin)",
        "tags": [
          "updates"
        ]
      },
      "put": {
        "description": "Enqueues `set_update_channel` for every enrolled server that follows the default and supports it.",
        "operationId": "setTenantUpdateSettings",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateSettingsView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpdateSettingsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change the organization's default channel (admin)",
        "tags": [
          "updates"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/terminal-sessions/{id}": {
      "delete": {
        "description": "Ends the session from the platform side (also another admin's). Audited. Requires `X-CSRF-Token`.",
        "operationId": "closeTerminalSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalSessionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "End a web terminal (admin)",
        "tags": [
          "terminal"
        ]
      }
    },
    "/tls/panel-host-allowed": {
      "get": {
        "description": "Asked by the edge Caddy (`on_demand_tls ask`) before it requests a certificate. 200 for a registered panel host, 404 otherwise. The public edge does not route this path.",
        "operationId": "panelHostAllowed",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "domain",
            "schema": {
              "maxLength": 253,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PanelHostAllowedOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Edge on-demand TLS check: is this a registered panel host?",
        "tags": [
          "tenant"
        ]
      }
    },
    "/updates/channels": {
      "get": {
        "description": "Read by pluspanel-os channel-sync.yml: the registry's :stable follows the fleet. {\"pluspanel-os\": {\"stable\": {\"version\", \"digest\", \"completed_at\"}, \"preview\": {…}}, \"pluspanel-agent\": {…}}. Cacheable 60 s.",
        "operationId": "getUpdateChannels",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "additionalProperties": {
                      "$ref": "#/components/schemas/ChannelReleaseView"
                    },
                    "type": "object"
                  },
                  "type": "object"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "The release each channel's last completed rollout reached (public, no authentication)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/releases": {
      "get": {
        "description": "Releases of the OS image and of the agent, seen by the release watcher or registered by an operator. Requires `updates.rollout` in the operator organization.",
        "operationId": "listUpdateReleases",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "component",
            "schema": {
              "enum": [
                "pluspanel-os",
                "pluspanel-agent"
              ],
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReleasesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List releases (operator)",
        "tags": [
          "updates"
        ]
      },
      "post": {
        "description": "Resolves the version tag in the registry (503 `updates_registry_unavailable`; 409 `release_digest_mismatch` when a given digest differs or the tag is labelled otherwise; 409 `release_version_taken` when the version is registered with another digest). Without a registry the digest is required.",
        "operationId": "registerUpdateRelease",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterReleaseInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReleaseView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Register a released version (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/rollouts": {
      "get": {
        "operationId": "listUpdateRollouts",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageRolloutView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List rollouts, newest first (operator)",
        "tags": [
          "updates"
        ]
      },
      "post": {
        "description": "Fixes the rings now (internal, canary 2 %, waves 10/50/100 %; deterministic order seeded by the release digest) and supersedes an active rollout of the same component and channel. channel stable is the promotion: 409 `release_not_on_preview` unless a preview rollout of the release completed, 422 `prerelease_on_stable`. Observation periods under 300 s are accepted only when every target is a lab server (422).",
        "operationId": "createUpdateRollout",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateRolloutInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Start a rollout of a release on a channel (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/rollouts/{id}": {
      "get": {
        "operationId": "getUpdateRollout",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutDetailView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a rollout with its rings, targets, gates and events (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/rollouts/{id}/cancel": {
      "post": {
        "description": "409 `rollout_state_conflict` when the rollout's state does not allow it; resume answers 409 `rollout_has_rollback_failed` while a server of the current ring is rollback_failed (cancel, or fix it).",
        "operationId": "cancelUpdateRollout",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Cancel a rollout; updated servers keep their version (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/rollouts/{id}/pause": {
      "post": {
        "description": "409 `rollout_state_conflict` when the rollout's state does not allow it; resume answers 409 `rollout_has_rollback_failed` while a server of the current ring is rollback_failed (cancel, or fix it).",
        "operationId": "pauseUpdateRollout",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Pause a running rollout (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/updates/rollouts/{id}/resume": {
      "post": {
        "description": "409 `rollout_state_conflict` when the rollout's state does not allow it; resume answers 409 `rollout_has_rollback_failed` while a server of the current ring is rollback_failed (cancel, or fix it).",
        "operationId": "resumeUpdateRollout",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Resume a paused or halted rollout; failed and rolled-back servers are retried (operator)",
        "tags": [
          "updates"
        ]
      }
    },
    "/users": {
      "get": {
        "operationId": "listUsers",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageUserView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List users (admins: the organization; resellers: the clients of their accounts)",
        "tags": [
          "users"
        ]
      },
      "post": {
        "description": "Requires `users.invite`. Admins invite any role; resellers invite clients onto accounts they own. The user is created in status `invited`; the answer carries the invitation token and path **once** (48 h, single use, stored only as argon2id). With `send_email` and SMTP configured it is also emailed. Audited `user.invite`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createUser",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateUserInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreateUserOutputBody"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Invite a user (one-time link, shown once)",
        "tags": [
          "users"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/users/{id}": {
      "delete": {
        "description": "Requires `users.manage` (ADR-0013 §4). 1. Without `confirm_token`: 202 `{confirm_token, expires_at}` (`ppu1_…`, single use, 10 minutes, SHA-256 only). 2. With `?confirm_token=`: 200 `{user}`: status `deleted`, e-mail `deleted-\u003cid\u003e@invalid`, display name emptied; password, authenticator app, passkeys, recovery codes, known devices, tokens and sessions removed. The id stays and audit rows are untouched. Never oneself (409 `conflict`), never the last active admin (409 `last_admin`), never a reseller that owns accounts (409 `conflict`). Errors: 422 `confirm_token_invalid`, 409 `confirm_token_expired` / `confirm_token_used`. Audited `user.delete_requested` and `user.pseudonymized`.",
        "operationId": "deleteUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Token from the first DELETE. Absent: issue a token only.",
            "explode": false,
            "in": "query",
            "name": "confirm_token",
            "schema": {
              "description": "Token from the first DELETE. Absent: issue a token only.",
              "maxLength": 64,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeleteUserOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeleteUserOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete a user: pseudonymization (two steps)",
        "tags": [
          "users"
        ]
      },
      "get": {
        "operationId": "getUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserDetailView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Get a user with its role, accounts and reseller limits",
        "tags": [
          "users"
        ]
      },
      "patch": {
        "description": "Requires `users.manage`. Never oneself. A reseller that owns accounts keeps its role (409). Disabling revokes the user's sessions. Audited `user.role` / `user.status`.",
        "operationId": "updateUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateUserInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserDetailView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a user's role or status (admin)",
        "tags": [
          "users"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/users/{id}/grants": {
      "get": {
        "operationId": "listUserGrants",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserGrantsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List a user's explicit permission grants (admin only)",
        "tags": [
          "users"
        ]
      }
    },
    "/users/{id}/grants/{permission}": {
      "delete": {
        "description": "Requires the `X-CSRF-Token` header.",
        "operationId": "revokeUserPermission",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "An explicit-only permission (held by no role).",
            "in": "path",
            "name": "permission",
            "required": true,
            "schema": {
              "description": "An explicit-only permission (held by no role).",
              "enum": [
                "jobs.test_probes"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Revoke an explicit permission (audited)",
        "tags": [
          "users"
        ]
      },
      "put": {
        "description": "Requires the `X-CSRF-Token` header. Explicit-only permissions are held by no role; an admin may grant them to any admin of the tenant, including themselves. Idempotent.",
        "operationId": "grantUserPermission",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "An explicit-only permission (held by no role).",
            "in": "path",
            "name": "permission",
            "required": true,
            "schema": {
              "description": "An explicit-only permission (held by no role).",
              "enum": [
                "jobs.test_probes"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GrantView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Grant an explicit-only permission to an admin (audited)",
        "tags": [
          "users"
        ]
      }
    },
    "/users/{id}/mfa": {
      "get": {
        "description": "Requires `users.manage`.",
        "operationId": "getUserMFA",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserMFAView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A user's second factors (admin)",
        "tags": [
          "users"
        ]
      }
    },
    "/users/{id}/mfa-reset": {
      "post": {
        "description": "Requires `users.manage`; never oneself. Removes the authenticator app, passkeys and recovery codes, signs the user out everywhere and e-mails them. Audited `auth.mfa_admin_reset`.",
        "operationId": "resetUserMFA",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "204": {
            "description": "No Content",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Reset a user's 2FA (admin)",
        "tags": [
          "users"
        ]
      }
    },
    "/users/{id}/password-reset": {
      "post": {
        "description": "Requires `users.invite` (resellers: clients all of whose accounts they own). An invited user gets a new invitation instead. Supersedes earlier links. Audited `user.password_reset_issued`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "issuePasswordReset",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasswordResetInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OneTimeLink"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Issue a one-time password reset link (shown once)",
        "tags": [
          "users"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/users/{id}/reseller-limits": {
      "get": {
        "operationId": "getResellerLimits",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ResellerLimitsView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A reseller's limits and allocations (admins; a reseller for itself)",
        "tags": [
          "users"
        ]
      },
      "put": {
        "description": "Requires `users.manage`. 409 `reseller_limit_exceeded` when the reseller's allocations are above the new limits. Audited.",
        "operationId": "setResellerLimits",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ResellerLimits"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ResellerLimitsView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Set a reseller's limits (admin)",
        "tags": [
          "users"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/users/{id}/sessions": {
      "delete": {
        "description": "Requires `users.manage`; never one's own (use DELETE /auth/sessions). Audited `auth.sessions_revoked`.",
        "operationId": "revokeUserSessions",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokedOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Sign out every session of a user (admin)",
        "tags": [
          "users"
        ]
      },
      "get": {
        "description": "Requires `users.manage`.",
        "operationId": "listUserSessions",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SessionsOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A user's live sessions (admin)",
        "tags": [
          "users"
        ]
      }
    },
    "/users/{id}/sessions/{sid}": {
      "delete": {
        "description": "Requires `users.manage`. Audited `auth.session_revoked`.",
        "operationId": "revokeUserSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "sid",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Sign out one session of a user (admin)",
        "tags": [
          "users"
        ]
      }
    },
    "/version": {
      "get": {
        "operationId": "version",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VersionBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Build identity (version and commit) of the running control plane",
        "tags": [
          "health"
        ]
      }
    },
    "/waitlist": {
      "get": {
        "operationId": "listWaitlist",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWaitlistEntryView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "List waitlist entries, newest first (operator admin only)",
        "tags": [
          "waitlist"
        ]
      },
      "post": {
        "description": "Public, unauthenticated. Rate limited per client IP and globally (429 with `Retry-After`). New, duplicate and honeypot submissions all answer 200 `{\"status\":\"ok\"}`. `consent` must be true.",
        "operationId": "joinWaitlist",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/JoinWaitlistInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JoinWaitlistOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Join the founding-members waitlist (public)",
        "tags": [
          "waitlist"
        ],
        "x-pluspanel-idempotency": false
      }
    },
    "/waitlist/export.csv": {
      "get": {
        "operationId": "exportWaitlist",
        "responses": {
          "200": {
            "content": {
              "text/csv": {}
            },
            "description": "CSV: id,email,name,locale,consented_at,created_at",
            "headers": {
              "Content-Disposition": {
                "schema": {
                  "type": "string"
                }
              },
              "Content-Type": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Export the whole waitlist as CSV (operator admin only)",
        "tags": [
          "waitlist"
        ]
      }
    },
    "/webhook-deliveries/{id}": {
      "get": {
        "description": "Requires `webhooks.read`. Attempts keep the status, duration and error class, never the response body. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "getWebhookDelivery",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookDeliveryDetail"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A delivery with its attempts and payload",
        "tags": [
          "webhooks"
        ]
      }
    },
    "/webhook-deliveries/{id}/redeliver": {
      "post": {
        "description": "Requires `webhooks.manage`. A new (manual) delivery of the same event to the same webhook, with its own retries. Audited `webhook.redelivered`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "redeliverWebhookDelivery",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookAcceptedOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Send a delivery's event again",
        "tags": [
          "webhooks"
        ]
      }
    },
    "/webhooks": {
      "get": {
        "description": "Requires `webhooks.read`. Newest first; secrets are never returned. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "listWebhooks",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWebhookView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Webhook subscriptions of the organization",
        "tags": [
          "webhooks"
        ]
      },
      "post": {
        "description": "Requires `webhooks.manage`. The URL must be HTTPS at a public address (private, loopback, link-local, CGNAT and the platform's ranges are refused, again at every connection). At most 20 per organization (409 `webhook_limit_reached`). The signing secret is in the answer only. Deliveries: POST of `{id, type, created_at, tenant_id, data}` with PlusPanel-Event, PlusPanel-Delivery, PlusPanel-Timestamp and PlusPanel-Signature (`t=\u003cunix\u003e,v1=\u003chex HMAC-SHA256(secret, \"\u003ct\u003e.\u003cbody\u003e\")\u003e`); a 2xx within 10 s is success, anything else is retried after 1 min, 5 min, 30 min, 2 h, 6 h and 12 h. Audited `webhook.created`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "createWebhook",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateWebhookInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookSecretOutputBody"
                }
              }
            },
            "description": "Created",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Create a webhook subscription",
        "tags": [
          "webhooks"
        ],
        "x-pluspanel-sensitive-response": true
      }
    },
    "/webhooks/event-types": {
      "get": {
        "description": "Requires `webhooks.read`. Every type a subscription can name; `reserved` types are documented but not sent yet.",
        "operationId": "listWebhookEventTypes",
        "parameters": [
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookEventTypesOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "$ref": "#/components/responses/ServiceUnavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "The public webhook event catalog",
        "tags": [
          "webhooks"
        ]
      }
    },
    "/webhooks/{id}": {
      "delete": {
        "description": "Requires `webhooks.manage`. Its secrets, deliveries and attempts go with it. Audited `webhook.deleted`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "deleteWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Delete a webhook subscription",
        "tags": [
          "webhooks"
        ]
      },
      "get": {
        "description": "Requires `webhooks.read`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "getWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "A webhook subscription",
        "tags": [
          "webhooks"
        ]
      },
      "patch": {
        "description": "Requires `webhooks.manage`. Fields left out stay. Deliveries of a disabled webhook wait until it is enabled again (or expire after 30 days). Audited `webhook.updated`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "updateWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfMatch"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchWebhookInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "$ref": "#/components/responses/PreconditionFailed"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Change a webhook subscription",
        "tags": [
          "webhooks"
        ],
        "x-pluspanel-etag": true
      }
    },
    "/webhooks/{id}/deliveries": {
      "get": {
        "description": "Requires `webhooks.read`. Newest first, kept 30 days. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "listWebhookDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's next_cursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's next_cursor.",
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "description": "Page size.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Only deliveries in this state.",
            "explode": false,
            "in": "query",
            "name": "state",
            "schema": {
              "description": "Only deliveries in this state.",
              "enum": [
                "pending",
                "succeeded",
                "failed",
                "dead"
              ],
              "type": "string"
            }
          },
          {
            "description": "Only deliveries of this event type.",
            "explode": false,
            "in": "query",
            "name": "event_type",
            "schema": {
              "description": "Only deliveries of this event type.",
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IfNoneMatch"
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWebhookDeliveryView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "description": "Strong entity tag of the representation (base64url SHA-256 of the body).",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "304": {
            "$ref": "#/components/responses/NotModified"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Deliveries of a webhook",
        "tags": [
          "webhooks"
        ]
      }
    },
    "/webhooks/{id}/ping": {
      "post": {
        "description": "Requires `webhooks.manage`. Queues a `webhook.ping` event for this webhook only (409 `webhook_disabled` when it is off); follow it with GET /webhook-deliveries/{delivery_id}. Audited `webhook.ping`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`.",
        "operationId": "pingWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookAcceptedOutputBody"
                }
              }
            },
            "description": "Accepted",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Send a test event",
        "tags": [
          "webhooks"
        ]
      }
    },
    "/webhooks/{id}/rotate-secret": {
      "post": {
        "description": "Requires `webhooks.manage`. The new secret is in the answer only; with `grace_seconds` (at most 86400) deliveries are signed with both secrets (two v1 values) until the grace ends. Audited `webhook.secret_rotated`. Without a vault key (PLUSPANEL_VAULT_KEK_FILE) every webhook operation answers 503 `webhooks_unavailable`. The answer carries a secret shown once: under an Idempotency-Key a repeated request answers 409 `idempotency_replay_unavailable`, never the secret again.",
        "operationId": "rotateWebhookSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateWebhookSecretInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/WebhookSecretOutputBody"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Idempotent-Replayed": {
                "description": "`true` when the answer is the stored outcome of an earlier request with the same Idempotency-Key.",
                "schema": {
                  "enum": [
                    "true"
                  ],
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/IdempotencyKeyInvalid"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "415": {
            "$ref": "#/components/responses/UnsupportedMediaType"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "$ref": "#/components/responses/RateLimited"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "session": []
          },
          {
            "apiKey": []
          }
        ],
        "summary": "Rotate a webhook's signing secret",
        "tags": [
          "webhooks"
        ],
        "x-pluspanel-sensitive-response": true
      }
    }
  },
  "servers": [
    {
      "url": "/api/v1"
    }
  ]
}