{"openapi":"3.1.1","info":{"title":"Pensec API","version":"1.1.0"},"servers":[{"url":"https://api.pensec.app"}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer"}},"schemas":{"Empty":{"type":"object","additionalProperties":false,"properties":{}},"Name":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100}}},"Member":{"type":"object","additionalProperties":false,"required":["subject","role"],"properties":{"subject":{"type":"string","minLength":1,"maxLength":100},"role":{"type":"string","enum":["admin","member","viewer"]}}},"Website":{"type":"object","additionalProperties":false,"required":["name","url","environment"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100},"url":{"type":"string","format":"uri","maxLength":2048},"environment":{"type":"string","enum":["production","staging"]}}},"Key":{"type":"object","additionalProperties":false,"required":["label","permissions","expiresAt"],"properties":{"label":{"type":"string","minLength":1,"maxLength":100},"websiteId":{"type":"string","format":"uuid"},"permissions":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["read","write","keys","members","notifications","review","publish"]}},"expiresAt":{"type":"integer","minimum":1}}},"Request":{"type":"object","additionalProperties":false,"properties":{"notes":{"type":"string","maxLength":2000}}},"Verify":{"type":"object","additionalProperties":false,"required":["method"],"properties":{"method":{"type":"string","enum":["dns","file"]}}},"Schedule":{"type":"object","additionalProperties":false,"required":["cadence"],"properties":{"cadence":{"type":"string","enum":["daily","weekly","off"]}}},"Run":{"type":"object","additionalProperties":false,"required":["idempotencyKey"],"properties":{"idempotencyKey":{"type":"string","format":"uuid"}}},"Task":{"type":"object","additionalProperties":false,"required":["title"],"properties":{"title":{"type":"string","minLength":1,"maxLength":200},"description":{"type":"string","maxLength":4000},"status":{"type":"string","enum":["open","in_progress","blocked","done","cancelled"]},"priority":{"type":"string","enum":["low","normal","high","urgent"]},"assigneeSubject":{"type":["string","null"],"maxLength":100},"dueAt":{"type":["integer","null"]},"reference":{"type":"object","additionalProperties":false,"properties":{"reportId":{"type":"string","format":"uuid"},"version":{"type":"integer","minimum":1},"findingId":{"type":"string","maxLength":80},"runId":{"type":"string","format":"uuid"}}},"expectedVersion":{"type":"integer","minimum":1}}},"Comment":{"type":"object","additionalProperties":false,"required":["text"],"properties":{"text":{"type":"string","minLength":1,"maxLength":4000}}},"Import":{"type":"object","additionalProperties":false,"required":["externalId","tool","toolVersion","status","environment","deployment","startedAt","finishedAt","coverage","findings","limitations"],"properties":{"externalId":{"type":"string","minLength":1,"maxLength":200},"tool":{"type":"string","minLength":1,"maxLength":100},"toolVersion":{"type":"string","minLength":1,"maxLength":100},"status":{"type":"string","enum":["completed","failed","cancelled","partial"]},"environment":{"type":"string","maxLength":100},"deployment":{"type":"string","maxLength":500},"startedAt":{"type":"string","format":"date-time"},"finishedAt":{"type":"string","format":"date-time"},"coverage":{"type":"array","maxItems":200,"items":{"type":"object","additionalProperties":false,"required":["label","status","detail"],"properties":{"label":{"type":"string","maxLength":200},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"detail":{"type":"string","maxLength":4000}}}},"findings":{"type":"array","maxItems":100,"items":{"type":"object","additionalProperties":false,"required":["id","title","severity","detail"],"properties":{"id":{"type":"string","minLength":1,"maxLength":80},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"detail":{"type":"string","maxLength":4000},"evidenceIds":{"type":"array","maxItems":10,"items":{"type":"string","format":"uuid"}}}}},"limitations":{"type":"array","minItems":1,"maxItems":30,"items":{"type":"string","minLength":1,"maxLength":4000}}}},"Evidence":{"type":"object","additionalProperties":false,"required":["text"],"properties":{"text":{"type":"string","minLength":1,"maxLength":60000}}},"Subscription":{"type":"object","additionalProperties":false,"required":["channel","destination","events"],"properties":{"websiteId":{"type":"string","format":"uuid"},"channel":{"type":"string","enum":["email","webhook"]},"destination":{"type":"string","minLength":1,"maxLength":2048},"events":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["task.created","task.updated","task.commented","assessment.requested","assessment.changed","run.completed","run.imported","report.published","finding.changed","notification.test"]}}}},"Publish":{"type":"object","additionalProperties":false,"required":["expectedVersion"],"properties":{"expectedVersion":{"type":"integer","minimum":0}}},"LegacyDocument":{"type":"object","additionalProperties":true,"description":"Existing report/execution document, further validated by its shared domain schema."},"Scope":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"description":{"type":"string","minLength":1,"maxLength":4000},"origins":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","maxLength":2048,"format":"uri"}},"exclusions":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"authorityReference":{"type":"string","minLength":1,"maxLength":500}},"required":["description","origins","exclusions","authorityReference"],"additionalProperties":false},"ReportInput":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"schemaVersion":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":200},"summary":{"type":"string","minLength":1,"maxLength":4000},"assessmentKind":{"type":"string","enum":["public_exposure","scoped_application"]},"execution":{"type":"object","properties":{"status":{"type":"string","enum":["completed","failed","cancelled","paused"]},"reason":{"type":"string","minLength":1,"maxLength":4000},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"finishedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"}},"required":["status","reason","startedAt","finishedAt"],"additionalProperties":false},"deployment":{"type":"object","properties":{"identity":{"type":"string","minLength":1,"maxLength":500},"provenance":{"type":"string","enum":["declared","observed","unknown"]}},"required":["identity","provenance"],"additionalProperties":false},"coverage":{"minItems":1,"maxItems":200,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"label":{"type":"string","minLength":1,"maxLength":200},"target":{"type":"string","maxLength":500},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"result":{"type":"string","enum":["expected_control","candidate","inconclusive","not_applicable"]},"detail":{"type":"string","minLength":1,"maxLength":4000}},"required":["id","label","target","status","result","detail"],"additionalProperties":false}},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"methodology":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"minItems":1,"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"retest":{"type":"object","properties":{"status":{"type":"string","const":"not_performed"},"summary":{"type":"string","minLength":1,"maxLength":4000}},"required":["status","summary"],"additionalProperties":false}},"required":["schemaVersion","title","summary","assessmentKind","execution","deployment","coverage","findings","methodology","limitations","retest"],"additionalProperties":false},"ReviewInput":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"contentDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"note":{"type":"string","minLength":1,"maxLength":4000},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"findingId":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"disposition":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"reproduction":{"type":"string","enum":["reproduced","not_attempted","inconclusive"]},"note":{"type":"string","minLength":1,"maxLength":4000}},"required":["findingId","disposition","reproduction","note"],"additionalProperties":false}}},"required":["contentDigest","note","findings"],"additionalProperties":false},"ExecutionPolicy":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"origin":{"type":"string","maxLength":2048},"operations":{"minItems":1,"maxItems":20,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"maxLength":300},"method":{"type":"string","enum":["GET","HEAD"]},"readSafe":{"type":"boolean","const":true}},"required":["path","method","readSafe"],"additionalProperties":false}},"approvalReference":{"type":"string","minLength":1,"maxLength":500},"scopeDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"validUntil":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"maxRequests":{"type":"integer","minimum":1,"maximum":200}},"required":["origin","operations","approvalReference","scopeDigest","validUntil","maxRequests"],"additionalProperties":false},"Engagement":{"type":"object","additionalProperties":false,"required":["applicationId","reviewerSubject","scope"],"properties":{"applicationId":{"type":"string","format":"uuid"},"requestId":{"type":"string","format":"uuid"},"reviewerSubject":{"type":"string","minLength":1,"maxLength":100},"scope":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"description":{"type":"string","minLength":1,"maxLength":4000},"origins":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","maxLength":2048,"format":"uri"}},"exclusions":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"authorityReference":{"type":"string","minLength":1,"maxLength":500}},"required":["description","origins","exclusions","authorityReference"],"additionalProperties":false}}},"Launch":{"type":"object","additionalProperties":false,"required":["idempotencyKey"],"properties":{"idempotencyKey":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,100}$"}}},"WebsiteSubscription":{"type":"object","additionalProperties":false,"required":["channel","destination","events"],"properties":{"channel":{"type":"string","enum":["email","webhook"]},"destination":{"type":"string","minLength":1,"maxLength":2048},"events":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["task.created","task.updated","task.commented","assessment.requested","assessment.changed","run.completed","run.imported","report.published","finding.changed","notification.test"]}}}},"ObjectResult":{"type":["object","null"]},"IdResult":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}},"DeletedTask":{"type":"object","required":["id","deleted"],"properties":{"id":{"type":"string"},"deleted":{"const":true}}},"FlagResult":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}},"Organizations":{"type":"object","required":["organizations"],"properties":{"organizations":{"type":"array","items":{"type":"object","required":["id","name","role"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"role":{"type":"string","enum":["owner","admin","member","viewer"]}}}}}},"Organization":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"createdAt":{"type":"integer"}}},"Members":{"type":"object","required":["members"],"properties":{"members":{"type":"array","items":{"type":"object","required":["subject","role"],"properties":{"subject":{"type":"string"},"name":{"type":["string","null"]},"role":{"type":"string"}}}}}},"MemberResult":{"type":"object","required":["subject","role"],"properties":{"subject":{"type":"string"},"role":{"type":"string"}}},"WebsiteResult":{"type":"object","required":["id","name","url","environment","organizationId"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"environment":{"type":"string"},"organizationId":{"type":"string"},"createdAt":{"type":"integer"}}},"Page":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}},"KeyResult":{"type":"object","required":["id","key","expiresAt"],"properties":{"id":{"type":"string"},"key":{"type":"string","pattern":"^psk_[A-Za-z0-9_-]{43}$"},"expiresAt":{"type":"integer"}}},"Keys":{"type":"object","required":["keys"],"properties":{"keys":{"type":"array","items":{"type":"object","required":["id","label","expiresAt"],"properties":{"id":{"type":"string"},"label":{"type":"string"},"websiteId":{"type":["string","null"]},"permissions":{"type":"array","items":{"type":"string"}},"expiresAt":{"type":"integer"},"revokedAt":{"type":["integer","null"]},"lastUsedAt":{"type":["integer","null"]}}}}}},"Agents":{"type":"object","required":["agents"],"properties":{"agents":{"type":"array","items":{"type":"object","required":["id","label"],"properties":{"id":{"type":"string"},"label":{"type":"string"},"organizationId":{"type":["string","null"]},"websiteId":{"type":["string","null"]},"revokedAt":{"type":["integer","null"]}}}}}},"Ownership":{"type":"object","required":["verified","verifiedUntil"],"properties":{"verified":{"type":"boolean"},"verifiedAt":{"type":["integer","null"]},"verifiedUntil":{"type":"integer"}}},"Challenge":{"type":"object","required":["recordName","recordType","value","filePath","fileUrl","expiresAt"],"properties":{"recordName":{"type":"string"},"recordType":{"const":"TXT"},"value":{"type":"string"},"filePath":{"type":"string"},"fileUrl":{"type":"string"},"expiresAt":{"type":"integer"}}},"Assessment":{"type":"object","required":["id","status","jobs"],"properties":{"id":{"type":"string"},"status":{"type":"string"},"reason":{"type":"string"},"reviewPending":{"type":"boolean"},"jobs":{"type":"array","items":{"type":"object"}}}},"ScheduleResult":{"type":"object","required":["cadence","nextRunAt"],"properties":{"cadence":{"type":"string","enum":["daily","weekly","off"]},"nextRunAt":{"type":["integer","null"]}}},"AutomatedTests":{"type":"object","required":["schedule","runs","usage"],"properties":{"schedule":{"type":["object","null"]},"runs":{"type":"array","items":{"type":"object"}},"usage":{"type":"object","required":["limit","used","mode"],"properties":{"limit":{"type":"integer"},"used":{"type":"integer"},"mode":{"const":"mock"}}}}},"Reports":{"type":"object","required":["reports","total","nextCursor"],"properties":{"reports":{"type":"array","items":{"type":"object"}},"total":{"type":"integer"},"nextCursor":{"type":["string","null"]}}},"ReportPointer":{"type":"object","required":["id","latestVersion"],"properties":{"id":{"type":"string"},"latestVersion":{"type":"integer","minimum":1}}},"TaskResult":{"type":"object","required":["id","version"],"properties":{"id":{"type":"string"},"version":{"type":"integer","minimum":1},"dashboardUrl":{"type":"string"}}},"TaskDetail":{"type":"object","required":["task","comments"],"properties":{"task":{"type":"object","required":["id","website_id","title","status","version"],"properties":{"id":{"type":"string"},"website_id":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"priority":{"type":"string"},"assignee_subject":{"type":["string","null"]},"version":{"type":"integer"}}},"comments":{"type":"array","items":{"type":"object"}}}},"ExternalResult":{"type":"object","required":["id","reviewStatus"],"properties":{"id":{"type":"string"},"reviewStatus":{"const":"not_reviewed"},"source":{"const":"external"},"digest":{"type":"string"},"duplicate":{"type":"boolean"}}},"ExternalRun":{"type":"object","required":["id","source","reviewStatus","coverage","findings","limitations"],"properties":{"id":{"type":"string"},"source":{"const":"external"},"reviewStatus":{"const":"not_reviewed"},"coverage":{"type":"array","items":{"type":"object"}},"findings":{"type":"array","items":{"type":"object","required":["id","title","confirmation"],"properties":{"id":{"type":"string"},"title":{"type":"string"},"confirmation":{"const":"candidate"}}}},"limitations":{"type":"array","items":{"type":"string"}}}},"EvidenceResult":{"type":"object","required":["id","digest"],"properties":{"id":{"type":"string"},"digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"text":{"type":"string"}}},"Stats":{"type":"object","required":["websites","tasks","managedRuns","externalRuns","assessmentRequests","assessments","schedules","ownership","reports","findings","usage","definitions"],"properties":{"websites":{"type":"integer"},"tasks":{"type":"array","items":{"type":"object"}},"managedRuns":{"type":"array","items":{"type":"object"}},"externalRuns":{"type":"array","items":{"type":"object"}},"assessmentRequests":{"type":"array","items":{"type":"object"}},"assessments":{"type":"array","items":{"type":"object"}},"schedules":{"type":"array","items":{"type":"object"}},"ownership":{"type":"object","required":["verified","unverified"],"properties":{"verified":{"type":"integer"},"unverified":{"type":"integer"}}},"reports":{"type":"integer"},"findings":{"type":"object","additionalProperties":{"type":"integer"}},"usage":{"type":"object"},"definitions":{"type":"object"}}},"Identity":{"type":"object","required":["user","credential","capabilities"],"properties":{"user":{"type":"object","required":["subject","provider"],"properties":{"subject":{"type":"string"},"provider":{"type":"string"},"name":{"type":["string","null"]},"email":{"type":["string","null"]}}},"credential":{"type":"object","required":["kind","organizationId","websiteId","permissions"],"properties":{"kind":{"type":"string"},"organizationId":{"type":["string","null"]},"websiteId":{"type":["string","null"]},"permissions":{"type":"array","items":{"type":"string"}}}},"capabilities":{"type":"object"}}},"Subscriptions":{"type":"object","required":["subscriptions"],"properties":{"subscriptions":{"type":"array","items":{"type":"object"}}}},"Engagements":{"type":"object","required":["engagements"],"properties":{"engagements":{"type":"array","items":{"type":"object"}}}},"ReportEdition":{"type":"object","properties":{"snapshot":{"type":"object","properties":{"schemaVersion":{"const":1},"reportId":{"type":"string"},"version":{"type":"integer"},"publishedAt":{"type":"string"},"contentDigest":{"type":"string"},"evidenceDigest":{"type":"string"},"content":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"schemaVersion":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":200},"summary":{"type":"string","minLength":1,"maxLength":4000},"assessmentKind":{"type":"string","enum":["public_exposure","scoped_application"]},"execution":{"type":"object","properties":{"status":{"type":"string","enum":["completed","failed","cancelled","paused"]},"reason":{"type":"string","minLength":1,"maxLength":4000},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"finishedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"}},"required":["status","reason","startedAt","finishedAt"],"additionalProperties":false},"deployment":{"type":"object","properties":{"identity":{"type":"string","minLength":1,"maxLength":500},"provenance":{"type":"string","enum":["declared","observed","unknown"]}},"required":["identity","provenance"],"additionalProperties":false},"coverage":{"minItems":1,"maxItems":200,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"label":{"type":"string","minLength":1,"maxLength":200},"target":{"type":"string","maxLength":500},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"result":{"type":"string","enum":["expected_control","candidate","inconclusive","not_applicable"]},"detail":{"type":"string","minLength":1,"maxLength":4000}},"required":["id","label","target","status","result","detail"],"additionalProperties":false}},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"methodology":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"minItems":1,"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"retest":{"type":"object","properties":{"status":{"type":"string","const":"not_performed"},"summary":{"type":"string","minLength":1,"maxLength":4000}},"required":["status","summary"],"additionalProperties":false},"application":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"environment":{"type":"string"}},"required":["id","name","url","environment"]},"scope":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"description":{"type":"string","minLength":1,"maxLength":4000},"origins":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","maxLength":2048,"format":"uri"}},"exclusions":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"authorityReference":{"type":"string","minLength":1,"maxLength":500},"version":{"type":"integer"},"digest":{"type":"string"}},"required":["description","origins","exclusions","authorityReference","version","digest"],"additionalProperties":false}},"required":["schemaVersion","title","summary","assessmentKind","execution","deployment","coverage","findings","methodology","limitations","retest","application","scope"],"additionalProperties":false},"review":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"contentDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"note":{"type":"string","minLength":1,"maxLength":4000},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"findingId":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"disposition":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"reproduction":{"type":"string","enum":["reproduced","not_attempted","inconclusive"]},"note":{"type":"string","minLength":1,"maxLength":4000}},"required":["findingId","disposition","reproduction","note"],"additionalProperties":false}},"reviewer":{"type":"object","properties":{"subject":{"type":"string"},"name":{"type":"string"}},"required":["subject","name"]},"signedAt":{"type":"string"},"evidenceDigest":{"type":"string"}},"required":["contentDigest","note","findings","reviewer","signedAt","evidenceDigest"],"additionalProperties":false}},"required":["schemaVersion","reportId","version","publishedAt","contentDigest","evidenceDigest","content","review"]},"digest":{"type":"string"},"versions":{"type":"array","items":{"type":"object","properties":{"version":{"type":"integer"},"publishedAt":{"type":"integer"},"digest":{"type":"string"}},"required":["version","publishedAt","digest"]}}},"required":["snapshot","digest","versions"]},"FindingResult":{"type":"object","properties":{"finding":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"required":["finding"]},"FindingEvidence":{"type":"object","properties":{"evidence":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"required":["evidence"]}}},"paths":{"/v1/me":{"get":{"operationId":"getIdentity","description":"Read the authenticated identity, grants and supported capabilities.","security":[{"bearer":[]}],"parameters":[],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["user","credential","capabilities"],"properties":{"user":{"type":"object","required":["subject","provider"],"properties":{"subject":{"type":"string"},"provider":{"type":"string"},"name":{"type":["string","null"]},"email":{"type":["string","null"]}}},"credential":{"type":"object","required":["kind","organizationId","websiteId","permissions"],"properties":{"kind":{"type":"string"},"organizationId":{"type":["string","null"]},"websiteId":{"type":["string","null"]},"permissions":{"type":"array","items":{"type":"string"}}}},"capabilities":{"type":"object"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"identity"}},"/v1/organizations":{"get":{"operationId":"listOrganizations","description":"List accessible organizations.","security":[{"bearer":[]}],"parameters":[],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["organizations"],"properties":{"organizations":{"type":"array","items":{"type":"object","required":["id","name","role"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"role":{"type":"string","enum":["owner","admin","member","viewer"]}}}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"identity"},"post":{"operationId":"createOrganization","description":"Create an organization. Requires a browser session or an account OAuth grant.","security":[{"bearer":[]}],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"createdAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"account"}},"/v1/organizations/{organizationId}":{"get":{"operationId":"getOrganization","description":"Read organization settings.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"createdAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"organization"},"patch":{"operationId":"updateOrganization","description":"Rename an organization.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"createdAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"members","x-scope":"organization"}},"/v1/organizations/{organizationId}/members":{"get":{"operationId":"listMembers","description":"List organization members.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["members"],"properties":{"members":{"type":"array","items":{"type":"object","required":["subject","role"],"properties":{"subject":{"type":"string"},"name":{"type":["string","null"]},"role":{"type":"string"}}}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"members","x-scope":"organization"},"post":{"operationId":"addMember","description":"Add or update an existing Pensec user's organization role.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["subject","role"],"properties":{"subject":{"type":"string","minLength":1,"maxLength":100},"role":{"type":"string","enum":["admin","member","viewer"]}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["subject","role"],"properties":{"subject":{"type":"string"},"role":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"members","x-scope":"organization"}},"/v1/organizations/{organizationId}/members/{subject}":{"delete":{"operationId":"removeMember","description":"Remove a non-owner organization member and immediately end their delegated access.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"subject","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"members","x-scope":"organization"}},"/v1/organizations/{organizationId}/stats":{"get":{"operationId":"getOrganizationStats","description":"Read organization statistics, separating mock, external and expert-reviewed results.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["websites","tasks","managedRuns","externalRuns","assessmentRequests","assessments","schedules","ownership","reports","findings","usage","definitions"],"properties":{"websites":{"type":"integer"},"tasks":{"type":"array","items":{"type":"object"}},"managedRuns":{"type":"array","items":{"type":"object"}},"externalRuns":{"type":"array","items":{"type":"object"}},"assessmentRequests":{"type":"array","items":{"type":"object"}},"assessments":{"type":"array","items":{"type":"object"}},"schedules":{"type":"array","items":{"type":"object"}},"ownership":{"type":"object","required":["verified","unverified"],"properties":{"verified":{"type":"integer"},"unverified":{"type":"integer"}}},"reports":{"type":"integer"},"findings":{"type":"object","additionalProperties":{"type":"integer"}},"usage":{"type":"object"},"definitions":{"type":"object"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"organization"}},"/v1/organizations/{organizationId}/websites":{"get":{"operationId":"listWebsites","description":"List websites directly under an organization.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"organization"},"post":{"operationId":"createWebsite","description":"Register a website; registration does not authorize or start testing.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["name","url","environment"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100},"url":{"type":"string","format":"uri","maxLength":2048},"environment":{"type":"string","enum":["production","staging"]}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"organization"}},"/v1/websites/{websiteId}":{"get":{"operationId":"getWebsite","description":"Read a website and its organization.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","name","url","environment","organizationId"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"environment":{"type":"string"},"organizationId":{"type":"string"},"createdAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"},"patch":{"operationId":"updateWebsite","description":"Rename a website without changing its tested origin or historical reports.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":100}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"createdAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/stats":{"get":{"operationId":"getWebsiteStats","description":"Read this website's statistics.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["websites","tasks","managedRuns","externalRuns","assessmentRequests","assessments","schedules","ownership","reports","findings","usage","definitions"],"properties":{"websites":{"type":"integer"},"tasks":{"type":"array","items":{"type":"object"}},"managedRuns":{"type":"array","items":{"type":"object"}},"externalRuns":{"type":"array","items":{"type":"object"}},"assessmentRequests":{"type":"array","items":{"type":"object"}},"assessments":{"type":"array","items":{"type":"object"}},"schedules":{"type":"array","items":{"type":"object"}},"ownership":{"type":"object","required":["verified","unverified"],"properties":{"verified":{"type":"integer"},"unverified":{"type":"integer"}}},"reports":{"type":"integer"},"findings":{"type":"object","additionalProperties":{"type":"integer"}},"usage":{"type":"object"},"definitions":{"type":"object"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"}},"/v1/organizations/{organizationId}/api-keys":{"get":{"operationId":"listApiKeys","description":"List key metadata; never returns saved key secrets.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["keys"],"properties":{"keys":{"type":"array","items":{"type":"object","required":["id","label","expiresAt"],"properties":{"id":{"type":"string"},"label":{"type":"string"},"websiteId":{"type":["string","null"]},"permissions":{"type":"array","items":{"type":"string"}},"expiresAt":{"type":"integer"},"revokedAt":{"type":["integer","null"]},"lastUsedAt":{"type":["integer","null"]}}}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"keys","x-scope":"organization"},"post":{"operationId":"createApiKey","description":"Create an organization or website-scoped key. Secret returned once; cannot exceed caller permissions.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["label","permissions","expiresAt"],"properties":{"label":{"type":"string","minLength":1,"maxLength":100},"websiteId":{"type":"string","format":"uuid"},"permissions":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["read","write","keys","members","notifications","review","publish"]}},"expiresAt":{"type":"integer","minimum":1}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","key","expiresAt"],"properties":{"id":{"type":"string"},"key":{"type":"string","pattern":"^psk_[A-Za-z0-9_-]{43}$"},"expiresAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"keys","x-scope":"organization"}},"/v1/api-keys/{keyId}":{"delete":{"operationId":"revokeApiKey","description":"Immediately revoke an API key.","security":[{"bearer":[]}],"parameters":[{"name":"keyId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"keys","x-scope":"key"}},"/v1/api-keys/{keyId}/rotate":{"post":{"operationId":"rotateApiKey","description":"Rotate a key, immediately invalidating its old secret.","security":[{"bearer":[]}],"parameters":[{"name":"keyId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","key","expiresAt"],"properties":{"id":{"type":"string"},"key":{"type":"string","pattern":"^psk_[A-Za-z0-9_-]{43}$"},"expiresAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"keys","x-scope":"key"}},"/v1/connected-agents":{"get":{"operationId":"listConnectedAgents","description":"List your OAuth and browser-login grants.","security":[{"bearer":[]}],"parameters":[],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["agents"],"properties":{"agents":{"type":"array","items":{"type":"object","required":["id","label"],"properties":{"id":{"type":"string"},"label":{"type":"string"},"organizationId":{"type":["string","null"]},"websiteId":{"type":["string","null"]},"revokedAt":{"type":["integer","null"]}}}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"identity"}},"/v1/connected-agents/{grantId}":{"delete":{"operationId":"revokeConnectedAgent","description":"Revoke your connected agent and its access/refresh tokens.","security":[{"bearer":[]}],"parameters":[{"name":"grantId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"identity"}},"/v1/websites/{websiteId}/ownership":{"get":{"operationId":"getOwnership","description":"Read current ownership verification.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["verified","verifiedUntil"],"properties":{"verified":{"type":"boolean"},"verifiedAt":{"type":["integer","null"]},"verifiedUntil":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"}},"/v1/websites/{websiteId}/ownership/challenge":{"post":{"operationId":"createOwnershipChallenge","description":"Create a DNS TXT or HTTPS file ownership challenge.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["recordName","recordType","value","filePath","fileUrl","expiresAt"],"properties":{"recordName":{"type":"string"},"recordType":{"const":"TXT"},"value":{"type":"string"},"filePath":{"type":"string"},"fileUrl":{"type":"string"},"expiresAt":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/ownership/verify":{"post":{"operationId":"verifyOwnership","description":"Verify a published ownership challenge; testing scope remains separate.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["method"],"properties":{"method":{"type":"string","enum":["dns","file"]}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["verified","verifiedUntil"],"properties":{"verified":{"type":"boolean"},"verifiedAt":{"type":["integer","null"]},"verifiedUntil":{"type":"integer"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/ownership/revoke":{"post":{"operationId":"revokeOwnership","description":"Revoke authority and stop affected active assessments.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/assessment-requests":{"get":{"operationId":"listAssessmentRequests","description":"List assessment requests for a website.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"},"post":{"operationId":"requestAssessment","description":"Create an assessment request awaiting scope confirmation; does not launch testing.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"notes":{"type":"string","maxLength":2000}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/assessment-requests/{requestId}/cancel":{"post":{"operationId":"cancelAssessmentRequest","description":"Cancel a pending assessment request.","security":[{"bearer":[]}],"parameters":[{"name":"requestId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"204":{"description":"Successful operation."},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"request"}},"/v1/websites/{websiteId}/assessments":{"get":{"operationId":"listAssessments","description":"List recorded expert-led assessments.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"}},"/v1/assessments/{assessmentId}":{"get":{"operationId":"getAssessment","description":"Read assessment progress, coverage and review handoff.","security":[{"bearer":[]}],"parameters":[{"name":"assessmentId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","status","jobs"],"properties":{"id":{"type":"string"},"status":{"type":"string"},"reason":{"type":"string"},"reviewPending":{"type":"boolean"},"jobs":{"type":"array","items":{"type":"object"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"assessment"}},"/v1/assessments/{assessmentId}/jobs/{jobId}/evidence":{"get":{"operationId":"getAssessmentEvidence","description":"Read a retained integrity-checked preliminary receipt.","security":[{"bearer":[]}],"parameters":[{"name":"assessmentId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"jobId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":["object","null"]}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"assessment"}},"/v1/assessments/{assessmentId}/cancel":{"post":{"operationId":"cancelAssessment","description":"Cancel an assessment using the existing execution stop controls.","security":[{"bearer":[]}],"parameters":[{"name":"assessmentId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":["object","null"]}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"assessment"}},"/v1/websites/{websiteId}/automated-tests":{"get":{"operationId":"getAutomatedTests","description":"Read schedules, mock runs and organization-wide usage.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["schedule","runs","usage"],"properties":{"schedule":{"type":["object","null"]},"runs":{"type":"array","items":{"type":"object"}},"usage":{"type":"object","required":["limit","used","mode"],"properties":{"limit":{"type":"integer"},"used":{"type":"integer"},"mode":{"const":"mock"}}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"}},"/v1/websites/{websiteId}/automated-tests/schedule":{"post":{"operationId":"setSchedule","description":"Set daily, weekly or paused automated checks. Expert review cadence remains weekly.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["cadence"],"properties":{"cadence":{"type":"string","enum":["daily","weekly","off"]}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["cadence","nextRunAt"],"properties":{"cadence":{"type":"string","enum":["daily","weekly","off"]},"nextRunAt":{"type":["integer","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/automated-tests/run":{"post":{"operationId":"requestTestRun","description":"Queue an idempotent managed run; current runner is mocked.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["idempotencyKey"],"properties":{"idempotencyKey":{"type":"string","format":"uuid"}}}}}},"responses":{"202":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/websites/{websiteId}/reports":{"get":{"operationId":"listReports","description":"List published reports for this website.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":50}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["reports","total","nextCursor"],"properties":{"reports":{"type":"array","items":{"type":"object"}},"total":{"type":"integer"},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"}},"/v1/reports/{reportId}":{"get":{"operationId":"getReport","description":"Read a report's latest published version pointer.","security":[{"bearer":[]}],"parameters":[{"name":"reportId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","latestVersion"],"properties":{"id":{"type":"string"},"latestVersion":{"type":"integer","minimum":1}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"report"}},"/v1/reports/{reportId}/versions/{version}":{"get":{"operationId":"getReportVersion","description":"Read an immutable report edition and actual review status.","security":[{"bearer":[]}],"parameters":[{"name":"reportId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"version","in":"path","required":true,"schema":{"type":"integer","minimum":1}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"snapshot":{"type":"object","properties":{"schemaVersion":{"const":1},"reportId":{"type":"string"},"version":{"type":"integer"},"publishedAt":{"type":"string"},"contentDigest":{"type":"string"},"evidenceDigest":{"type":"string"},"content":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"schemaVersion":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":200},"summary":{"type":"string","minLength":1,"maxLength":4000},"assessmentKind":{"type":"string","enum":["public_exposure","scoped_application"]},"execution":{"type":"object","properties":{"status":{"type":"string","enum":["completed","failed","cancelled","paused"]},"reason":{"type":"string","minLength":1,"maxLength":4000},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"finishedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"}},"required":["status","reason","startedAt","finishedAt"],"additionalProperties":false},"deployment":{"type":"object","properties":{"identity":{"type":"string","minLength":1,"maxLength":500},"provenance":{"type":"string","enum":["declared","observed","unknown"]}},"required":["identity","provenance"],"additionalProperties":false},"coverage":{"minItems":1,"maxItems":200,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"label":{"type":"string","minLength":1,"maxLength":200},"target":{"type":"string","maxLength":500},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"result":{"type":"string","enum":["expected_control","candidate","inconclusive","not_applicable"]},"detail":{"type":"string","minLength":1,"maxLength":4000}},"required":["id","label","target","status","result","detail"],"additionalProperties":false}},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"methodology":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"minItems":1,"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"retest":{"type":"object","properties":{"status":{"type":"string","const":"not_performed"},"summary":{"type":"string","minLength":1,"maxLength":4000}},"required":["status","summary"],"additionalProperties":false},"application":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"environment":{"type":"string"}},"required":["id","name","url","environment"]},"scope":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"description":{"type":"string","minLength":1,"maxLength":4000},"origins":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","maxLength":2048,"format":"uri"}},"exclusions":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"authorityReference":{"type":"string","minLength":1,"maxLength":500},"version":{"type":"integer"},"digest":{"type":"string"}},"required":["description","origins","exclusions","authorityReference","version","digest"],"additionalProperties":false}},"required":["schemaVersion","title","summary","assessmentKind","execution","deployment","coverage","findings","methodology","limitations","retest","application","scope"],"additionalProperties":false},"review":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"contentDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"note":{"type":"string","minLength":1,"maxLength":4000},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"findingId":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"disposition":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"reproduction":{"type":"string","enum":["reproduced","not_attempted","inconclusive"]},"note":{"type":"string","minLength":1,"maxLength":4000}},"required":["findingId","disposition","reproduction","note"],"additionalProperties":false}},"reviewer":{"type":"object","properties":{"subject":{"type":"string"},"name":{"type":"string"}},"required":["subject","name"]},"signedAt":{"type":"string"},"evidenceDigest":{"type":"string"}},"required":["contentDigest","note","findings","reviewer","signedAt","evidenceDigest"],"additionalProperties":false}},"required":["schemaVersion","reportId","version","publishedAt","contentDigest","evidenceDigest","content","review"]},"digest":{"type":"string"},"versions":{"type":"array","items":{"type":"object","properties":{"version":{"type":"integer"},"publishedAt":{"type":"integer"},"digest":{"type":"string"}},"required":["version","publishedAt","digest"]}}},"required":["snapshot","digest","versions"]}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"report"}},"/v1/reports/{reportId}/versions/{version}/findings/{findingId}":{"get":{"operationId":"getFinding","description":"Read a finding in an exact report edition.","security":[{"bearer":[]}],"parameters":[{"name":"reportId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"version","in":"path","required":true,"schema":{"type":"integer","minimum":1}},{"name":"findingId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"finding":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"required":["finding"]}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"report"}},"/v1/reports/{reportId}/versions/{version}/findings/{findingId}/evidence/{evidenceId}":{"get":{"operationId":"getFindingEvidence","description":"Read redacted evidence in an exact report edition.","security":[{"bearer":[]}],"parameters":[{"name":"reportId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"version","in":"path","required":true,"schema":{"type":"integer","minimum":1}},{"name":"findingId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"evidenceId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"evidence":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"required":["evidence"]}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"report"}},"/v1/websites/{websiteId}/tasks":{"get":{"operationId":"listTasks","description":"List remediation and assessment tasks.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"},"post":{"operationId":"createTask","description":"Create a task linked to a website and optional finding/run.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["title"],"properties":{"title":{"type":"string","minLength":1,"maxLength":200},"description":{"type":"string","maxLength":4000},"status":{"type":"string","enum":["open","in_progress","blocked","done","cancelled"]},"priority":{"type":"string","enum":["low","normal","high","urgent"]},"assigneeSubject":{"type":["string","null"],"maxLength":100},"dueAt":{"type":["integer","null"]},"reference":{"type":"object","additionalProperties":false,"properties":{"reportId":{"type":"string","format":"uuid"},"version":{"type":"integer","minimum":1},"findingId":{"type":"string","maxLength":80},"runId":{"type":"string","format":"uuid"}}},"expectedVersion":{"type":"integer","minimum":1}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","version"],"properties":{"id":{"type":"string"},"version":{"type":"integer","minimum":1},"dashboardUrl":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/tasks/{taskId}":{"get":{"operationId":"getTask","description":"Read a task and comments.","security":[{"bearer":[]}],"parameters":[{"name":"taskId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["task","comments"],"properties":{"task":{"type":"object","required":["id","website_id","title","status","version"],"properties":{"id":{"type":"string"},"website_id":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"priority":{"type":"string"},"assignee_subject":{"type":["string","null"]},"version":{"type":"integer"}}},"comments":{"type":"array","items":{"type":"object"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"task"},"patch":{"operationId":"updateTask","description":"Update a task using expectedVersion; task completion is not verified finding closure.","security":[{"bearer":[]}],"parameters":[{"name":"taskId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["title"],"properties":{"title":{"type":"string","minLength":1,"maxLength":200},"description":{"type":"string","maxLength":4000},"status":{"type":"string","enum":["open","in_progress","blocked","done","cancelled"]},"priority":{"type":"string","enum":["low","normal","high","urgent"]},"assigneeSubject":{"type":["string","null"],"maxLength":100},"dueAt":{"type":["integer","null"]},"reference":{"type":"object","additionalProperties":false,"properties":{"reportId":{"type":"string","format":"uuid"},"version":{"type":"integer","minimum":1},"findingId":{"type":"string","maxLength":80},"runId":{"type":"string","format":"uuid"}}},"expectedVersion":{"type":"integer","minimum":1}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","version"],"properties":{"id":{"type":"string"},"version":{"type":"integer","minimum":1},"dashboardUrl":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"task"},"delete":{"operationId":"deleteTask","description":"Delete a task from active views. Its comments and action history are retained; report findings remain unchanged.","security":[{"bearer":[]}],"parameters":[{"name":"taskId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","deleted"],"properties":{"id":{"type":"string"},"deleted":{"const":true}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"task"}},"/v1/tasks/{taskId}/comments":{"post":{"operationId":"addTaskComment","description":"Add an attributed task comment.","security":[{"bearer":[]}],"parameters":[{"name":"taskId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["text"],"properties":{"text":{"type":"string","minLength":1,"maxLength":4000}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"task"}},"/v1/websites/{websiteId}/external-runs":{"get":{"operationId":"listExternalRuns","description":"List externally imported test runs, separately from Pensec-managed runs.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"website"},"post":{"operationId":"importTestRun","description":"Import idempotent externally attributed results. Imported findings are not expert-reviewed.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["externalId","tool","toolVersion","status","environment","deployment","startedAt","finishedAt","coverage","findings","limitations"],"properties":{"externalId":{"type":"string","minLength":1,"maxLength":200},"tool":{"type":"string","minLength":1,"maxLength":100},"toolVersion":{"type":"string","minLength":1,"maxLength":100},"status":{"type":"string","enum":["completed","failed","cancelled","partial"]},"environment":{"type":"string","maxLength":100},"deployment":{"type":"string","maxLength":500},"startedAt":{"type":"string","format":"date-time"},"finishedAt":{"type":"string","format":"date-time"},"coverage":{"type":"array","maxItems":200,"items":{"type":"object","additionalProperties":false,"required":["label","status","detail"],"properties":{"label":{"type":"string","maxLength":200},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"detail":{"type":"string","maxLength":4000}}}},"findings":{"type":"array","maxItems":100,"items":{"type":"object","additionalProperties":false,"required":["id","title","severity","detail"],"properties":{"id":{"type":"string","minLength":1,"maxLength":80},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"detail":{"type":"string","maxLength":4000},"evidenceIds":{"type":"array","maxItems":10,"items":{"type":"string","format":"uuid"}}}}},"limitations":{"type":"array","minItems":1,"maxItems":30,"items":{"type":"string","minLength":1,"maxLength":4000}}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","reviewStatus"],"properties":{"id":{"type":"string"},"reviewStatus":{"const":"not_reviewed"},"source":{"const":"external"},"digest":{"type":"string"},"duplicate":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/external-runs/{runId}":{"get":{"operationId":"getExternalRun","description":"Read imported coverage, candidate findings and provenance.","security":[{"bearer":[]}],"parameters":[{"name":"runId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","source","reviewStatus","coverage","findings","limitations"],"properties":{"id":{"type":"string"},"source":{"const":"external"},"reviewStatus":{"const":"not_reviewed"},"coverage":{"type":"array","items":{"type":"object"}},"findings":{"type":"array","items":{"type":"object","required":["id","title","confirmation"],"properties":{"id":{"type":"string"},"title":{"type":"string"},"confirmation":{"const":"candidate"}}}},"limitations":{"type":"array","items":{"type":"string"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"externalRun"}},"/v1/websites/{websiteId}/evidence":{"post":{"operationId":"uploadEvidence","description":"Store a bounded redacted plain-text evidence artifact in private R2.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["text"],"properties":{"text":{"type":"string","minLength":1,"maxLength":60000}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","digest"],"properties":{"id":{"type":"string"},"digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"text":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"write","x-scope":"website"}},"/v1/evidence/{uploadId}":{"get":{"operationId":"getUploadedEvidence","description":"Read an integrity-checked uploaded evidence artifact.","security":[{"bearer":[]}],"parameters":[{"name":"uploadId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id","digest"],"properties":{"id":{"type":"string"},"digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"text":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"read","x-scope":"upload"}},"/v1/websites/{websiteId}/subscriptions":{"get":{"operationId":"listWebsiteSubscriptions","description":"List only this website's email and webhook subscriptions.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["subscriptions"],"properties":{"subscriptions":{"type":"array","items":{"type":"object"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"website"},"post":{"operationId":"createWebsiteSubscription","description":"Subscribe this website to events using a website-scoped credential.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["channel","destination","events"],"properties":{"channel":{"type":"string","enum":["email","webhook"]},"destination":{"type":"string","minLength":1,"maxLength":2048},"events":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["task.created","task.updated","task.commented","assessment.requested","assessment.changed","run.completed","run.imported","report.published","finding.changed","notification.test"]}}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"website"}},"/v1/websites/{websiteId}/deliveries":{"get":{"operationId":"listWebsiteDeliveries","description":"Inspect notification deliveries for this website only.","security":[{"bearer":[]}],"parameters":[{"name":"websiteId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"website"}},"/v1/organizations/{organizationId}/subscriptions":{"get":{"operationId":"listSubscriptions","description":"List email and signed webhook subscriptions.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["subscriptions"],"properties":{"subscriptions":{"type":"array","items":{"type":"object"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"organization"},"post":{"operationId":"createSubscription","description":"Subscribe configured destinations to project-free organization/website events.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["channel","destination","events"],"properties":{"websiteId":{"type":"string","format":"uuid"},"channel":{"type":"string","enum":["email","webhook"]},"destination":{"type":"string","minLength":1,"maxLength":2048},"events":{"type":"array","minItems":1,"maxItems":20,"uniqueItems":true,"items":{"type":"string","enum":["task.created","task.updated","task.commented","assessment.requested","assessment.changed","run.completed","run.imported","report.published","finding.changed","notification.test"]}}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"organization"}},"/v1/subscriptions/{subscriptionId}":{"delete":{"operationId":"deleteSubscription","description":"Disable an email or webhook subscription.","security":[{"bearer":[]}],"parameters":[{"name":"subscriptionId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"},"removed":{"type":"boolean"},"disabled":{"type":"boolean"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"subscription"}},"/v1/subscriptions/{subscriptionId}/test":{"post":{"operationId":"testSubscription","description":"Queue a test notification to the configured destination.","security":[{"bearer":[]}],"parameters":[{"name":"subscriptionId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"subscription"}},"/v1/organizations/{organizationId}/deliveries":{"get":{"operationId":"listDeliveries","description":"Inspect notification deliveries and retries.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"organization"}},"/v1/deliveries/{deliveryId}/retry":{"post":{"operationId":"retryDelivery","description":"Retry a failed notification using the saved destination.","security":[{"bearer":[]}],"parameters":[{"name":"deliveryId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"notifications","x-scope":"delivery"}},"/v1/organizations/{organizationId}/audit":{"get":{"operationId":"listAuditEvents","description":"Inspect attributed API and MCP actions without request bodies or secrets.","security":[{"bearer":[]}],"parameters":[{"name":"organizationId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string","maxLength":1000}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["items","nextCursor"],"properties":{"items":{"type":"array","items":{"type":"object"}},"nextCursor":{"type":["string","null"]}}}}}},"default":{"description":"Structured API error"}},"x-permission":"members","x-scope":"organization"}},"/v1/review/engagements":{"get":{"operationId":"listEngagements","description":"List staff-authorized assessment engagements.","security":[{"bearer":[]}],"parameters":[],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["engagements"],"properties":{"engagements":{"type":"array","items":{"type":"object"}}}}}}},"default":{"description":"Structured API error"}},"x-permission":"review","x-scope":"staff"},"post":{"operationId":"createEngagement","description":"Create an engagement and assign an existing reviewer; requires publisher role.","security":[{"bearer":[]}],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["applicationId","reviewerSubject","scope"],"properties":{"applicationId":{"type":"string","format":"uuid"},"requestId":{"type":"string","format":"uuid"},"reviewerSubject":{"type":"string","minLength":1,"maxLength":100},"scope":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"description":{"type":"string","minLength":1,"maxLength":4000},"origins":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","maxLength":2048,"format":"uri"}},"exclusions":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"authorityReference":{"type":"string","minLength":1,"maxLength":500}},"required":["description","origins","exclusions","authorityReference"],"additionalProperties":false}}}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"publish","x-scope":"staff"}},"/v1/review/engagements/{engagementId}/drafts":{"post":{"operationId":"createReportDraft","description":"Import a report draft using the full report domain schema and reviewer assignment.","security":[{"bearer":[]}],"parameters":[{"name":"engagementId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"schemaVersion":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":200},"summary":{"type":"string","minLength":1,"maxLength":4000},"assessmentKind":{"type":"string","enum":["public_exposure","scoped_application"]},"execution":{"type":"object","properties":{"status":{"type":"string","enum":["completed","failed","cancelled","paused"]},"reason":{"type":"string","minLength":1,"maxLength":4000},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"finishedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"}},"required":["status","reason","startedAt","finishedAt"],"additionalProperties":false},"deployment":{"type":"object","properties":{"identity":{"type":"string","minLength":1,"maxLength":500},"provenance":{"type":"string","enum":["declared","observed","unknown"]}},"required":["identity","provenance"],"additionalProperties":false},"coverage":{"minItems":1,"maxItems":200,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"label":{"type":"string","minLength":1,"maxLength":200},"target":{"type":"string","maxLength":500},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"result":{"type":"string","enum":["expected_control","candidate","inconclusive","not_applicable"]},"detail":{"type":"string","minLength":1,"maxLength":4000}},"required":["id","label","target","status","result","detail"],"additionalProperties":false}},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"methodology":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"minItems":1,"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"retest":{"type":"object","properties":{"status":{"type":"string","const":"not_performed"},"summary":{"type":"string","minLength":1,"maxLength":4000}},"required":["status","summary"],"additionalProperties":false}},"required":["schemaVersion","title","summary","assessmentKind","execution","deployment","coverage","findings","methodology","limitations","retest"],"additionalProperties":false}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"review","x-scope":"staff"}},"/v1/review/drafts/{draftId}":{"get":{"operationId":"getReportDraft","description":"Read an assigned report draft and its digests.","security":[{"bearer":[]}],"parameters":[{"name":"draftId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":["object","null"]}}}},"default":{"description":"Structured API error"}},"x-permission":"review","x-scope":"staff"}},"/v1/review/drafts/{draftId}/amend":{"post":{"operationId":"amendReportDraft","description":"Create an immutable amendment retaining evidence provenance.","security":[{"bearer":[]}],"parameters":[{"name":"draftId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"schemaVersion":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":200},"summary":{"type":"string","minLength":1,"maxLength":4000},"assessmentKind":{"type":"string","enum":["public_exposure","scoped_application"]},"execution":{"type":"object","properties":{"status":{"type":"string","enum":["completed","failed","cancelled","paused"]},"reason":{"type":"string","minLength":1,"maxLength":4000},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"finishedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"}},"required":["status","reason","startedAt","finishedAt"],"additionalProperties":false},"deployment":{"type":"object","properties":{"identity":{"type":"string","minLength":1,"maxLength":500},"provenance":{"type":"string","enum":["declared","observed","unknown"]}},"required":["identity","provenance"],"additionalProperties":false},"coverage":{"minItems":1,"maxItems":200,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"label":{"type":"string","minLength":1,"maxLength":200},"target":{"type":"string","maxLength":500},"status":{"type":"string","enum":["exercised","partial","blocked","untested","excluded"]},"result":{"type":"string","enum":["expected_control","candidate","inconclusive","not_applicable"]},"detail":{"type":"string","minLength":1,"maxLength":4000}},"required":["id","label","target","status","result","detail"],"additionalProperties":false}},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"number":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"short":{"type":"string","minLength":1,"maxLength":120},"title":{"type":"string","minLength":1,"maxLength":250},"severity":{"type":"string","enum":["critical","high","medium","low","informational"]},"confirmation":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"path":{"type":"string","maxLength":500},"category":{"type":"string","minLength":1,"maxLength":120},"impact":{"type":"string","minLength":1,"maxLength":4000},"prerequisites":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"type":"string","minLength":1,"maxLength":4000},"fix":{"type":"string","minLength":1,"maxLength":4000},"retestCriteria":{"type":"string","minLength":1,"maxLength":4000},"remediation":{"type":"string","enum":["open","in_progress","fix_reported","awaiting_deployment","ready_for_retest","risk_accepted"]},"evidence":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"description":{"type":"string","minLength":1,"maxLength":4000},"observedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"actor":{"type":"string","maxLength":200},"expected":{"type":"string","minLength":1,"maxLength":4000},"observed":{"type":"string","minLength":1,"maxLength":4000},"code":{"type":"string","minLength":1,"maxLength":12000},"redacted":{"type":"boolean","const":true}},"required":["id","description","observedAt","actor","expected","observed","code","redacted"],"additionalProperties":false}},"agentAssessment":{"type":"object","properties":{"text":{"type":"string","minLength":1,"maxLength":4000},"model":{"type":"string","maxLength":150},"evidenceIds":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"}}},"required":["text","model","evidenceIds"],"additionalProperties":false}},"required":["id","number","short","title","severity","confirmation","path","category","impact","prerequisites","limitations","fix","retestCriteria","remediation","evidence"],"additionalProperties":false}},"methodology":{"type":"string","minLength":1,"maxLength":4000},"limitations":{"minItems":1,"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":4000}},"retest":{"type":"object","properties":{"status":{"type":"string","const":"not_performed"},"summary":{"type":"string","minLength":1,"maxLength":4000}},"required":["status","summary"],"additionalProperties":false}},"required":["schemaVersion","title","summary","assessmentKind","execution","deployment","coverage","findings","methodology","limitations","retest"],"additionalProperties":false}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"review","x-scope":"staff"}},"/v1/review/drafts/{draftId}/sign-off":{"post":{"operationId":"signOffReportDraft","description":"Record an actual assigned review of exact content/evidence digests; agents cannot claim a human review.","security":[{"bearer":[]}],"parameters":[{"name":"draftId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"contentDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"note":{"type":"string","minLength":1,"maxLength":4000},"findings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"findingId":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,80}$"},"disposition":{"type":"string","enum":["confirmed","informational","candidate","inconclusive","disputed","dismissed"]},"reproduction":{"type":"string","enum":["reproduced","not_attempted","inconclusive"]},"note":{"type":"string","minLength":1,"maxLength":4000}},"required":["findingId","disposition","reproduction","note"],"additionalProperties":false}}},"required":["contentDigest","note","findings"],"additionalProperties":false}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":["object","null"]}}}},"default":{"description":"Structured API error"}},"x-permission":"review","x-scope":"staff"}},"/v1/review/drafts/{draftId}/publish":{"post":{"operationId":"publishReportDraft","description":"Publish an already signed immutable edition with publisher authorization.","security":[{"bearer":[]}],"parameters":[{"name":"draftId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["expectedVersion"],"properties":{"expectedVersion":{"type":"integer","minimum":0}}}}}},"responses":{"200":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":["object","null"]}}}},"default":{"description":"Structured API error"}},"x-permission":"publish","x-scope":"staff"}},"/v1/review/engagements/{engagementId}/execution-policies":{"post":{"operationId":"approveExecutionPolicy","description":"Approve a bounded immutable execution policy after verification and scope checks.","security":[{"bearer":[]}],"parameters":[{"name":"engagementId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"origin":{"type":"string","maxLength":2048},"operations":{"minItems":1,"maxItems":20,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"maxLength":300},"method":{"type":"string","enum":["GET","HEAD"]},"readSafe":{"type":"boolean","const":true}},"required":["path","method","readSafe"],"additionalProperties":false}},"approvalReference":{"type":"string","minLength":1,"maxLength":500},"scopeDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"validUntil":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"},"maxRequests":{"type":"integer","minimum":1,"maximum":200}},"required":["origin","operations","approvalReference","scopeDigest","validUntil","maxRequests"],"additionalProperties":false}}}},"responses":{"201":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"publish","x-scope":"staff"}},"/v1/review/execution-policies/{policyId}/launch":{"post":{"operationId":"launchAssessment","description":"Launch approved assessment execution only when the existing execution readiness flag permits it.","security":[{"bearer":[]}],"parameters":[{"name":"policyId","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[A-Za-z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["idempotencyKey"],"properties":{"idempotencyKey":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,100}$"}}}}}},"responses":{"202":{"description":"Successful operation.","content":{"application/json":{"schema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"}}}}}},"default":{"description":"Structured API error"}},"x-permission":"publish","x-scope":"staff"}}}}