{
  "swagger": "2.0",
  "info": {
    "title": "Humanbound API",
    "version": "production.humanbound::2.0.158",
    "description": "Humanbound API documentation"
  },
  "paths": {
    "/auth": {
      "get": {
        "summary": "Login/Sign up",
        "tags": [
          "Auth"
        ],
        "description": "Logins/Registers the user and returns the user profile + default org. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AuthResponse"
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "/auth/{id}": {
      "get": {
        "summary": "Login/Sign up with an invitation",
        "tags": [
          "Auth"
        ],
        "description": "Logins/Registers the user accepting an invitation and returns the user profile + default org. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AuthResponse"
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/logout": {
      "get": {
        "summary": "Logout",
        "tags": [
          "Auth"
        ],
        "description": "Logs out the user",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "/ping": {
      "get": {
        "summary": "Health Check",
        "tags": [
          "System"
        ],
        "description": "Health check endpoint to verify API is running.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [],
        "parameters": []
      }
    },
    "/docs": {
      "get": {
        "summary": "API Documentation",
        "tags": [
          "System"
        ],
        "description": "Returns OpenAPI/Swagger specification for all API endpoints.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [],
        "parameters": []
      }
    },
    "/scan": {
      "post": {
        "summary": "Unified multi-source agent scanner",
        "tags": [
          "Discovery"
        ],
        "description": "Scan an AI agent from multiple sources (url, endpoint, agentic, text). Accepts 1-4 sources, collects data from each in parallel, then runs a unified LLM analysis. Returns scope, risk_profile, security_posture, recommendations, and optionally default_integration. Domain validation applies only to `url` source. Rate-limited via session. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/UnifiedScanResponse"
            }
          },
          "400": {
            "description": "Invalid request, source data, or duplicate source types."
          },
          "401": {
            "description": "Authentication required."
          },
          "403": {
            "description": "Access level not permitted or URL domain mismatch."
          },
          "429": {
            "description": "Concurrent request limit exceeded."
          },
          "500": {
            "description": "Analysis failed."
          },
          "502": {
            "description": "All sources failed to collect data."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/UnifiedScanRequest"
            }
          }
        ]
      }
    },
    "/organisations": {
      "get": {
        "summary": "Get all organisations of the current user",
        "tags": [
          "Organisations"
        ],
        "description": "Get all organisations of the current user. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_OrganisationsResponse"
              }
            }
          },
          "401": {
            "description": "Unauthenticated"
          },
          "403": {
            "description": "Unauthorized"
          },
          "400": {
            "description": "Validation error"
          },
          "500": {
            "description": "Server error"
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      },
      "post": {
        "summary": "Create an organisation",
        "tags": [
          "Organisations"
        ],
        "description": "Create an organisation. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OKMessage"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/OrganisationUpdate"
            }
          }
        ]
      }
    },
    "/organisations/{id}": {
      "get": {
        "summary": "Get organisation by id",
        "tags": [
          "Organisations"
        ],
        "description": "Get organisation details by id. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OrganisationResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update organisation by id",
        "tags": [
          "Organisations"
        ],
        "description": "Update organisation by id. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OKMessage"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/OrganisationUpdate"
            }
          }
        ]
      }
    },
    "/organisations/{id}/switch": {
      "get": {
        "summary": "Switch to organisation.",
        "tags": [
          "Organisations"
        ],
        "description": "Switch to this organisation and authorize access. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OrganisationLoginResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/report": {
      "get": {
        "summary": "Generate organisation HTML report",
        "tags": [
          "Organisations"
        ],
        "description": "Generate a branded HTML security report for the organisation. Includes posture overview, findings summary, all projects with grades and monitoring status. Returns `text/html`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Organisation not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects": {
      "post": {
        "summary": "Create a new project",
        "tags": [
          "Projects"
        ],
        "description": "Creates a new project with the provided details. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ProjectsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Projects"
            }
          }
        ]
      },
      "get": {
        "summary": "Get all user's projects",
        "tags": [
          "Projects"
        ],
        "description": "Get all user's projects. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_ProjectsResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}": {
      "get": {
        "summary": "Get project by ID",
        "tags": [
          "Projects"
        ],
        "description": "Fetches project details by its ID. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/ProjectsResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update project by ID (Basic)",
        "tags": [
          "Projects"
        ],
        "description": "Finds & updates a project by its ID. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ProjectUpdate"
            }
          }
        ]
      },
      "delete": {
        "summary": "Delete a project by ID",
        "tags": [
          "Projects"
        ],
        "description": "Finds & deletes a project by its ID. Blocked if experiments are still running. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "409": {
            "description": "Cannot delete while experiments are running."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/api_key": {
      "put": {
        "summary": "Regenerate API Key.",
        "tags": [
          "Projects"
        ],
        "description": "Regenerate an API Key for this project. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ProjectsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ProjectUpdate"
            }
          }
        ]
      }
    },
    "/projects/{id}/status": {
      "get": {
        "summary": "Project activity status",
        "tags": [
          "Projects"
        ],
        "description": "Lightweight activity probe \u2014 returns whether anything is running for this project (active campaign, in-flight experiments, last posture snapshot). Used by dashboards and the CLI to render the live state without pulling the full project payload. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/report": {
      "get": {
        "summary": "Generate project HTML report",
        "tags": [
          "Projects"
        ],
        "description": "Generate a branded HTML security report for a project. Includes posture (multi-dimension), findings, threat landscape, assessment history (last 90 days), and human feedback audit. Returns `text/html`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found or archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/analyse": {
      "post": {
        "summary": "Analyse agent description (Deprecated)",
        "tags": [
          "Projects"
        ],
        "description": "**DEPRECATED \u2014 Use `POST /scan` with a `text` source instead.**\n\nAnalyses an agent's description to extract business scope, permitted intents, restricted intents, and recommended security restrictions.\n\nAccepts JSON with 'data' field containing the agent description (50-6000 characters).\n\nInput validation: Blocks dangerous patterns (HTML tags, scripts, injection attempts). Accepts any legitimate business text including international characters.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Analysis returned with business scope, permitted/restricted intents, and recommended additional restrictions."
          },
          "400": {
            "description": "Invalid input: empty text, too short/long, or contains unsafe patterns."
          },
          "418": {
            "description": "Input content makes no sense or lacks sufficient information."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ProjectAnalyseRequest"
            }
          }
        ]
      }
    },
    "/projects/analyse/agentic": {
      "post": {
        "summary": "Analyse agentic systems (Deprecated)",
        "tags": [
          "Projects"
        ],
        "description": "**DEPRECATED \u2014 Use `POST /scan` with an `agentic` source instead.** Analyses agentic system configurations (instructions + tools) to extract business scope and security intents.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Analysis returned."
          },
          "400": {
            "description": "Invalid agentic configuration."
          },
          "418": {
            "description": "Agentic definition is invalid, lacks information, or nonsensical."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/AgenticConfig"
            }
          }
        ]
      }
    },
    "/projects/{id}/logs/{result}/{fail_category}": {
      "get": {
        "summary": "Get project logs",
        "tags": [
          "Logs"
        ],
        "description": "Get all logs for a project. Supports filtering by result, fail_category, domain, date range, threat_class, gen_category. Pagination via page/size params.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/posture": {
      "get": {
        "summary": "Get security posture",
        "tags": [
          "Projects"
        ],
        "description": "Get security posture for a project. Returns overall score, grade, and breakdown by finding metrics, coverage metrics, and resilience metrics. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ProjectPosture"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/posture/trends": {
      "get": {
        "summary": "Get posture trends over time",
        "tags": [
          "Projects"
        ],
        "description": "Get posture score trend data over a time range. Auto-selects granularity: raw (<=7d), daily (8-30d), weekly (31-90d), monthly (>90d). Query params: days (default 30), start_date (ISO 8601, overrides days), end_date (ISO 8601, defaults to now). All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/PostureTrendsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "400": {
            "description": "Invalid date format or days parameter."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/findings": {
      "get": {
        "summary": "Get project findings",
        "tags": [
          "Projects"
        ],
        "description": "Get all findings for a project. Query params: status (open, stale, fixed, regressed), severity (critical, high, medium, low, info), threat_class (unified threat model key), page, page_size. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/FindingsResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/findings/{finding_id}": {
      "get": {
        "summary": "Get finding detail",
        "tags": [
          "Projects"
        ],
        "description": "Get a single finding by id. Scoped to the caller's organisation and project \u2014 findings from other projects return 404. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/FindingsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project or finding not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update finding",
        "tags": [
          "Projects"
        ],
        "description": "Update a finding's status, severity, or delegation. Status: open, fixed, stale. Severity: critical, high, medium, low, info. Delegation: set assignee_id (user UUID) and delegation_status (unassigned, assigned, acknowledged, resolved, escalated). Setting assignee_id auto-sets delegation_status to 'assigned' and records delegated_at timestamp. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "403": {
            "description": "Access level not permitted or finding does not belong to project."
          },
          "404": {
            "description": "Project or finding not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/FindingsUpdate"
            }
          }
        ]
      }
    },
    "/projects/{id}/findings/{finding_id}/evidence": {
      "get": {
        "summary": "Get logs that contributed to a finding",
        "tags": [
          "Projects"
        ],
        "description": "Paginated list of logs referenced by `findings.log_ids` \u2014 the conversations that produced the finding. Used for evidence drill-down in reports and the UI. Query params: `page`, `size` (default 15). All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project, finding, or finding's log_ids not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/findings/{id}/retest": {
      "post": {
        "summary": "Retest a finding (regression)",
        "tags": [
          "Projects"
        ],
        "description": "Re-run a finding's own recorded attacks against the current agent to check if it still reproduces (regression test). Body: {testing_level: unit|system|acceptance}. Creates a `_regression` experiment and kicks off the async run; returns 202 with the new `experiment_id`. The project is resolved from the finding \u2014 no `project_id` header required. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Project or finding not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/findings/{id}/regressions": {
      "get": {
        "summary": "List a finding's regression-retest history",
        "tags": [
          "Projects"
        ],
        "description": "List a finding's regression-retest history (each entry = one past retest: outcome, partial, testing_level, created_at). Newest first. Empty list when the finding has never been retested. The project is resolved from the finding \u2014 no `project_id` header required. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/dict"
              }
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project or finding not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/coverage": {
      "get": {
        "summary": "Get coverage summary",
        "tags": [
          "Projects"
        ],
        "description": "Get coverage summary for a project. Query params: include_gaps (true/false, default false), view ('threat_class' for per-threat-class effectiveness data). All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/CoverageWithGapsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/policy-recommendations": {
      "get": {
        "summary": "List policy recommendations",
        "tags": [
          "Projects"
        ],
        "description": "Paginated list of policy recommendations generated for this project. Query params: `page`, `size`. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PolicyRecommendationResponse"
              }
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/policy-recommendations/{recommendation_id}": {
      "get": {
        "summary": "Get policy recommendation detail",
        "tags": [
          "Projects"
        ],
        "description": "Get a single policy recommendation by id. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/PolicyRecommendationResponse"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project or recommendation not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/policy-recommendation/{recommendation_id}/revert": {
      "post": {
        "summary": "Revert policy recommendation",
        "tags": [
          "Projects"
        ],
        "description": "Revert an auto-applied policy recommendation, restoring the previous scope. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "Recommendation not auto_applied or no previous scope."
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Project or policy recommendation not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/guardrails/export/{vendor}": {
      "get": {
        "summary": "Export guardrails configuration",
        "tags": [
          "Projects"
        ],
        "description": "Export guardrails configuration in vendor-specific format. Vendors: 'openai' (OpenAI Guardrails format), 'humanbound' (Native Scope schema). Query params vary by vendor. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "400": {
            "description": "Vendor not supported or invalid parameters."
          },
          "404": {
            "description": "Project or recommendation not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/few-shot-examples": {
      "get": {
        "summary": "List few-shot examples",
        "tags": [
          "Few-Shot Learning"
        ],
        "description": "Get all few-shot learning examples for a project. Returns examples used for LLM judge training. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{project_id}/few-shot-examples/{id}": {
      "delete": {
        "summary": "Delete few-shot example",
        "tags": [
          "Few-Shot Learning"
        ],
        "description": "Delete a few-shot example. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "project_id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/datasets/conversations": {
      "post": {
        "summary": "Upload conversation logs for evaluation",
        "tags": [
          "Logs Auditor"
        ],
        "description": "Upload conversation logs as a dataset for evaluation by the logs_auditor orchestrator.\n\n**Two modes:**\n\n**1. Normalized** \u2014 pre-formatted Turn data (no `source` field):\n```json\n{\n    \"tag\": \"qa_batch_001\",\n    \"conversations\": [\n        {\n            \"thread_id\": \"optional-id\",\n            \"conversation\": [\n                {\"u\": \"user message\", \"a\": \"assistant response\"}\n            ],\n            \"metadata\": {\"source\": \"production\"}\n        }\n    ]\n}\n```\n\n**2. Raw import** \u2014 `source` triggers transformation of raw AI tool logs:\n```json\n{\n    \"source\": \"claude_code\",\n    \"tag\": \"audit_001\",\n    \"conversations\": [[...raw JSONL entries...]]\n}\n```\n\n**Supported sources:** `claude_code`, `openclaw`, `langfuse`\n\n**Transformation rules (raw import):**\n- Assistant text + tool calls/results included (for security analysis)\n- Thinking blocks stripped (internal reasoning)\n- Sidechains/sub-agent messages become separate conversations\n- Tool calls formatted as `[Tool: name] input` / `[Result] output`\n\n**Common fields:** `lang` (default \"Agnostic\"), `testing_level` (default \"production\")\n\n**Flow:**\n1. Upload conversations via this endpoint \u2192 returns `dataset_id` and `test_category`\n2. Create experiment with `test_category: \"humanbound/adversarial/logs_auditor::{tag}\"` and `configuration.auditor.parent: \"humanbound/adversarial/owasp_agentic\"` (or any other orchestrator)\n3. Run experiment \u2192 parent Judge evaluates each conversation\n\nSupports both JWT auth (UI) and project API key auth (CI/CD via x-api-key header). Only `owner`, `admin`, and `developer` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ConversationUploadResponse"
            }
          },
          "400": {
            "description": "Invalid request body, source, tag format, or empty conversations."
          },
          "403": {
            "description": "Access level not permitted or invalid project API key."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "409": {
            "description": "Dataset with this tag already exists."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ConversationUploadRequest"
            }
          }
        ]
      }
    },
    "/projects/{id}/campaign": {
      "get": {
        "summary": "Get campaign",
        "tags": [
          "Campaigns"
        ],
        "description": "Get the current campaign for a project. Returns the most recent campaign's plan, activity, status, and a count of synthesized strategies. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "401": {
            "description": "Project not found, archived, or access not allowed."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/campaign/terminate": {
      "post": {
        "summary": "Terminate running campaign",
        "tags": [
          "Campaigns"
        ],
        "description": "Terminate a running campaign for a project. Body: {\"campaign_id\": \"...\"}. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "Missing campaign_id or campaign is not running."
          },
          "401": {
            "description": "Project not found, archived, or insufficient access level."
          },
          "403": {
            "description": "Campaign does not belong to this project."
          },
          "404": {
            "description": "Campaign not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/ascam/pause": {
      "put": {
        "summary": "Pause or resume ASCAM monitoring",
        "tags": [
          "Campaigns"
        ],
        "description": "Pause or resume the ASCAM daily monitoring scan for a project. Body: {\"paused\": true | false}. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "'paused' field missing or not boolean."
          },
          "401": {
            "description": "Project not found, archived, or insufficient access level."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments": {
      "post": {
        "summary": "Create a new experiment. Start running in the background.",
        "tags": [
          "Experiments"
        ],
        "description": "Create a new experiment and schedule it for execution. If `configuration.integration` is not provided and the project has a `default_integration` (set via POST /scan with an endpoint source), the project default is used automatically. This means experiments can be created without explicitly specifying bot endpoints when the project already has a configured integration. `campaign_id` is not accepted in the body; create a custom assessment via POST /projects/{id}/assessments instead. Only `owner`, `admin`, and `developer` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ExperimentsResponse"
            }
          },
          "409": {
            "description": "An experiment for the defined configuration is already running (conflict)."
          },
          "400": {
            "description": "Validation error/Bad Request. Returned if neither integration nor auditor is provided and the project has no default_integration, or if campaign_id is present in the body."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Experiments"
            }
          }
        ]
      },
      "get": {
        "summary": "Get all experiments for this project.",
        "tags": [
          "Experiments"
        ],
        "description": "Get all user-created experiments for project. Include 'project_id' header. System experiments (created by ASCAM) are excluded. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_ExperimentsResponse"
              }
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}": {
      "get": {
        "summary": "Get experiment by id.",
        "tags": [
          "Experiments"
        ],
        "description": "Get experiments in details by its id. Include 'project_id' header. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ExperimentAugmentedResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update an experiment",
        "tags": [
          "Experiments"
        ],
        "description": "Update an experiment. Include 'project_id' header. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ExperimentPublicUpdate"
            }
          }
        ]
      },
      "delete": {
        "summary": "Delete an experiment by ID",
        "tags": [
          "Experiments"
        ],
        "description": "Finds & deletes an experiment by its ID. Include 'project_id' header. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/status": {
      "get": {
        "summary": "Experiment status polling.",
        "tags": [
          "Experiments"
        ],
        "description": "Get experiment's status by id. Include 'project_id' header. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ExperimentsResponseStatus"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/-/status": {
      "get": {
        "summary": "Experiments status polling.",
        "tags": [
          "Experiments"
        ],
        "description": "Get experiments status. Return a list. Include 'project_id' header. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ExperimentsResponseStatus"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/datasets": {
      "post": {
        "summary": "Get the datasets used in this experiment",
        "tags": [
          "Experiments"
        ],
        "description": "Finds & returns an experiment's datasets by its ID. Include 'project_id' header. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/str"
              }
            }
          },
          "404": {
            "description": "No datasets found for this experiment."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/logs": {
      "get": {
        "summary": "[DEPRECATED] Get an experiment's logs",
        "tags": [
          "Experiments"
        ],
        "description": "Get the experiment logs. Filters can be applied as query string params (available keys: `result`, `fail_category`, `gen_category`, `threat_class` - csv is supported for multiple selection per filter). `threat_class` resolves to matching `fail_category` values and takes precedence over `fail_category` if both are provided. Use also `representatives=true/false` to indicate if only representative logs or all logs should be fetched. Adversarial log responses include an enriched `threat_class` field. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "page",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "size",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          }
        ]
      }
    },
    "/experiments/{id}/analyse": {
      "post": {
        "summary": "Recommend restrictions",
        "tags": [
          "Experiments"
        ],
        "description": "Analyse the insights of this experiment and recommend new restricted intents. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/RecommendedScope"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/terminate": {
      "post": {
        "summary": "Recommend restrictions",
        "tags": [
          "Experiments"
        ],
        "description": "Terminate an experiment. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OKMessage"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/report": {
      "get": {
        "summary": "Generate experiment HTML report",
        "tags": [
          "Experiments"
        ],
        "description": "Generate a branded HTML security report for a specific experiment. Includes orchestrator-specific methodology context (OWASP for adversarial, QA evaluation dimensions for behavioral), metrics, vulnerabilities, and full conversation logs. Returns `text/html`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Experiment not found or archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/flagged-for-review": {
      "get": {
        "summary": "Get flagged logs for review",
        "tags": [
          "Experiments"
        ],
        "description": "Get logs that may need review based on representative feedback. When a human reviews a representative log and disagrees with the judge, this returns other logs in the same cluster that may have the same issue. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/FlaggedForReviewResponse"
            }
          },
          "401": {
            "description": "Access is not allowed."
          },
          "403": {
            "description": "Experiment not found or is archived."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{p_id}/experiments/{e_id}/clone": {
      "post": {
        "summary": "Clone an experiment",
        "tags": [
          "Experiments"
        ],
        "description": "Create a copy of an existing experiment with same configuration. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ExperimentsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Experiment not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "p_id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/firewall/{id}": {
      "post": {
        "summary": "Firewall",
        "tags": [
          "Firewall"
        ],
        "description": "Access the firewall for a deployed project. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/FirewallResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [],
        "parameters": [
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Firewall"
            }
          }
        ]
      }
    },
    "/firewall/{firewall_id}/logs/{log_id}": {
      "post": {
        "summary": "Get the specific firewall log.",
        "tags": [
          "Projects"
        ],
        "description": "Get the specific firewall log. Anonymously accessible.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/FirewallEval"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [],
        "parameters": [
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "firewall_id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/providers": {
      "post": {
        "summary": "Model Providers",
        "tags": [
          "Providers"
        ],
        "description": "Set up a new model provider. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/Providers"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Providers"
            }
          }
        ]
      },
      "get": {
        "summary": "Model Providers",
        "tags": [
          "Providers"
        ],
        "description": "Get the model providers for an organisation. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ProvidersResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          }
        ]
      }
    },
    "/providers/{id}": {
      "put": {
        "summary": "Model Providers",
        "tags": [
          "Providers"
        ],
        "description": "Update a model provider data. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/Providers"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Providers"
            }
          }
        ]
      },
      "get": {
        "summary": "Get Model Provider",
        "tags": [
          "Providers"
        ],
        "description": "Get a specific model provider by ID. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ProvidersResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Provider not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "delete": {
        "summary": "Model Providers",
        "tags": [
          "Providers"
        ],
        "description": "Delete this model provider. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "logs/{id}": {
      "post": {
        "summary": "Feedback Registration",
        "tags": [
          "Logs"
        ],
        "description": "Regster the expert's feedback for a log entry. Only `expert` level.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Feedback"
            }
          }
        ]
      }
    },
    "/logs/{id}": {
      "get": {
        "summary": "Get the specified log.",
        "tags": [
          "Logs"
        ],
        "description": "Get the specified log.. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/LogResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "delete": {
        "summary": "Remove feedback from log",
        "tags": [
          "Logs"
        ],
        "description": "Remove the expert's feedback from a log entry. Only `expert` level.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Log not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "project_id",
            "required": true,
            "description": "Project id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/experiments/{id}/logs/{result}/{fail_category}": {
      "get": {
        "summary": "Get experiment logs",
        "tags": [
          "Logs"
        ],
        "description": "Get logs for a specific experiment. Supports filtering by result, fail_category, is_representative, domain, date range.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Experiment not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/assessments/{id}/logs/{result}/{fail_category}": {
      "get": {
        "summary": "Get assessment logs",
        "tags": [
          "Logs"
        ],
        "description": "Get logs from all experiments in an assessment. Supports filtering by result, fail_category, domain, date range.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Assessment not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/findings/{id}/logs/{result}/{fail_category}": {
      "get": {
        "summary": "Get finding logs",
        "tags": [
          "Logs"
        ],
        "description": "Get logs linked to a specific finding (evidence trail). Returns the conversations that contributed to this finding.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_Logs"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Finding not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "members": {
      "get": {
        "summary": "Get organisation members.",
        "tags": [
          "Members"
        ],
        "description": "List all (including the invited) members. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/MergedSelectors"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          }
        ]
      },
      "post": {
        "summary": "Invite members.",
        "tags": [
          "Members"
        ],
        "description": "Invite a new member. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/Members"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Invitation"
            }
          }
        ]
      }
    },
    "members/{id}": {
      "put": {
        "summary": "Update member access level.",
        "tags": [
          "Members"
        ],
        "description": "Update a member's access level or other mutable fields. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/MemberResponse"
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Member not found in this organisation."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/MemberUpdate"
            }
          }
        ]
      },
      "delete": {
        "summary": "Revoke invitation/access.",
        "tags": [
          "Members"
        ],
        "description": "Remove by user id (owner_id of membership/invitation). Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          }
        ]
      }
    },
    "members/by-user/{user_id}": {
      "get": {
        "summary": "Get member by user id.",
        "tags": [
          "Members"
        ],
        "description": "Resolve the Members row for a given user_id within the current organisation. Used by clients that have a user id and need the member context (access level, accepted state). All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/MemberResponse"
            }
          },
          "404": {
            "description": "User is not a member of this organisation."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "user_id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "subscriptions": {
      "get": {
        "summary": "List the current user's subscriptions.",
        "tags": [
          "Subscriptions"
        ],
        "description": "Returns every subscription the user has access to (org owner OR accepted Members row of any access level on any org under the sub), each item with the organisations attached embedded as an `organisations` array of OrganisationResponse.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/SubscriptionResponse"
              }
            }
          },
          "401": {
            "description": "Authentication required."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "subscriptions/{id}": {
      "get": {
        "summary": "Get subscription details.",
        "tags": [
          "Subscriptions"
        ],
        "description": "Returns the subscription with computed `quota_alerts` (matching the shape `/organisations/{id}/switch` embeds). Any member of any org under the sub can read.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/SubscriptionLoginResponse"
            }
          },
          "401": {
            "description": "Subscription not found, or access is not allowed."
          },
          "404": {
            "description": "Subscription not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "subscriptions/{id}/organisations": {
      "get": {
        "summary": "List organisations attached to a subscription.",
        "tags": [
          "Subscriptions"
        ],
        "description": "Returns every organisation linked to this subscription (OrganisationResponse[]). Any member of any org under the sub can read.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OrganisationResponse"
              }
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "subscriptions/{id}/credits": {
      "get": {
        "summary": "Subscription credit balance + 30-day spend summary.",
        "tags": [
          "Subscriptions"
        ],
        "description": "Returns `credits_remaining`, `credits_granted_total`, `low_credit_warning`, and `last_30_days` (debits_by_kind, total_debits, total_grants). Restricted to org owners/admins of any org under the subscription. For seats/organisations usage too, see `/subscriptions/{id}/usage`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "subscriptions/{id}/usage": {
      "get": {
        "summary": "Consolidated subscription usage (credits + seats + organisations).",
        "tags": [
          "Subscriptions"
        ],
        "description": "Returns `plan_level`, `status`, `credits` (`remaining`, `allowance`, `granted_total`, `low_warning`, `last_30_days`), `seats` (`used`/`limit`), and `organisations` (`used`/`limit`). Compute usage as `allowance - remaining` (NOT against `granted_total`, which is the lifetime grant sum). `limit`/`allowance` null = unlimited/custom. Restricted to org owners/admins of any org under the subscription.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Subscription not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "subscriptions/{id}/credits/transactions": {
      "get": {
        "summary": "Paginated credit transaction history.",
        "tags": [
          "Subscriptions"
        ],
        "description": "Paginated ledger entries for the subscription. Optional query params: `page`, `size` (max 200), `kind` (e.g. `grant_signup`, `grant_topup`, `grant_reset`, `log_charge`, `token_charge`), `since` (epoch seconds), `until` (epoch seconds). Restricted to org owners/admins of any org under the subscription.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "/api-keys": {
      "post": {
        "summary": "Create API Key",
        "tags": [
          "API Keys"
        ],
        "description": "Create a new API key (hb_\u2026 secret, returned only once) for headless access. Optional scope (read/write/admin), organisations and projects selection (default [\"*\"] = all the owner can reach), and expires_at (epoch seconds).",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ApiKeyResponse"
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ApiKeyCreateRequest"
            }
          }
        ]
      },
      "get": {
        "summary": "List API Keys",
        "tags": [
          "API Keys"
        ],
        "description": "Get all API keys for the authenticated user. Returns key prefixes only, never the full keys.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/PaginationResponse_ApiKeysResponse"
              }
            }
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "page",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "limit",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          }
        ]
      }
    },
    "/api-keys/{id}": {
      "get": {
        "summary": "Get API Key",
        "tags": [
          "API Keys"
        ],
        "description": "Get a specific API key by ID. Returns key prefix only, never the full key.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ApiKeyResponse"
            }
          },
          "403": {
            "description": "Not authorized to access this API key."
          },
          "404": {
            "description": "API key not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update API Key",
        "tags": [
          "API Keys"
        ],
        "description": "Update an API key's name, status, or permissions. Cannot update the actual key value.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ApiKeyResponse"
            }
          },
          "403": {
            "description": "Not authorized to update this API key."
          },
          "404": {
            "description": "API key not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ApiKeyUpdate"
            }
          }
        ]
      },
      "delete": {
        "summary": "Delete API Key",
        "tags": [
          "API Keys"
        ],
        "description": "Permanently delete an API key. This action cannot be undone.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Not authorized to delete this API key."
          },
          "404": {
            "description": "API key not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/posture": {
      "get": {
        "summary": "Get organisation security posture",
        "tags": [
          "Organisations"
        ],
        "description": "Get aggregated security posture across all active projects in an organisation. Returns average score, grade distribution, risk level, worst project, and findings rollup. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OrgPostureResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Organisation not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/posture/trends": {
      "get": {
        "summary": "Get organisation posture trends",
        "tags": [
          "Organisations"
        ],
        "description": "Get aggregated posture trend data across all active projects over a time range. Auto-selects granularity: raw (<=7d), daily (8-30d), weekly (31-90d), monthly (>90d). Query params: days (default 30), start_date (ISO 8601, overrides days), end_date (ISO 8601, defaults to now). All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/PostureTrendsResponse"
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Organisation not found."
          },
          "400": {
            "description": "Invalid date format or days parameter."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/webhooks": {
      "post": {
        "summary": "Create webhook",
        "tags": [
          "Webhooks"
        ],
        "description": "Create a new webhook for the organisation. URL must be HTTPS. Auto-generates signing secret if not provided. Max 10 webhooks per org. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/WebhookResponse"
            }
          },
          "400": {
            "description": "Invalid URL, event types, or org limit reached."
          },
          "403": {
            "description": "Access level not permitted."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/object"
            }
          }
        ]
      },
      "get": {
        "summary": "List webhooks",
        "tags": [
          "Webhooks"
        ],
        "description": "List all webhooks for the organisation. Secrets are masked (first 7 chars only). Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/WebhookResponse"
              }
            }
          },
          "403": {
            "description": "Access level not permitted."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/webhooks/{wh_id}": {
      "get": {
        "summary": "Get webhook",
        "tags": [
          "Webhooks"
        ],
        "description": "Get a single webhook configuration. Secret is masked. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/WebhookResponse"
            }
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      },
      "put": {
        "summary": "Update webhook",
        "tags": [
          "Webhooks"
        ],
        "description": "Partial update of webhook configuration. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "Invalid URL or event types."
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/object"
            }
          }
        ]
      },
      "delete": {
        "summary": "Delete webhook",
        "tags": [
          "Webhooks"
        ],
        "description": "Delete a webhook and its delivery logs. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/webhooks/{wh_id}/deliveries": {
      "get": {
        "summary": "List webhook deliveries",
        "tags": [
          "Webhooks"
        ],
        "description": "Get paginated delivery log for a webhook. Includes status codes, errors, and retry attempts. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/WebhookDeliveryResponse"
              }
            }
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/webhooks/{wh_id}/test": {
      "post": {
        "summary": "Test webhook",
        "tags": [
          "Webhooks"
        ],
        "description": "Send a synthetic test.ping event to verify webhook connectivity. Does not persist to the event audit log. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "502": {
            "description": "Test ping delivery failed."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/webhooks/{wh_id}/replay": {
      "post": {
        "summary": "Replay historical events",
        "tags": [
          "Webhooks"
        ],
        "description": "Replay historical security events through a webhook for SIEM backfill. Requires `siem_integration` feature on subscription. Enforces 1-hour cooldown between replays and 1000-event cap per request. Delivery runs asynchronously. Supports API key (x-api-key) or JWT auth. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/OKMessage"
            }
          },
          "400": {
            "description": "Too many matching events (>1000) or invalid timestamp."
          },
          "403": {
            "description": "Feature not enabled or access level not permitted."
          },
          "404": {
            "description": "Webhook not found."
          },
          "429": {
            "description": "Replay cooldown active (1 hour between replays)."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/object"
            }
          }
        ]
      }
    },
    "/organisations/{id}/security-events": {
      "get": {
        "summary": "List security events",
        "tags": [
          "Security Events"
        ],
        "description": "Pull paginated security events for an organisation. Supports dual auth: API key (x-api-key header, for M2M/connector use) or standard JWT. Query params: page (default 1), size (default 50, max 200), event_type, project_id, since (ISO 8601 or Unix timestamp), until (ISO 8601 or Unix timestamp). Only `owner` and `admin` levels (JWT) or valid API key owner with org access.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/WebhookEventResponse"
              }
            }
          },
          "400": {
            "description": "Invalid timestamp format or query parameters."
          },
          "401": {
            "description": "Invalid API key or insufficient access."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "page",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "size",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "event_type",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "project_id",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "since",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "until",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          }
        ]
      }
    },
    "/threat-model": {
      "get": {
        "summary": "List threat classes",
        "tags": [
          "Threat Model"
        ],
        "description": "List all threat classes in the global threat taxonomy. Returns unified threat definitions with external_mappings containing: { frameworks: [{ framework, label, version, url, entries: [{ ref, title, url, remediation[] }] }] }. Frameworks: OWASP LLM (2025), OWASP Agentic AI (2026), EU AI Act, GDPR, NIST AI RMF, ISO 42001, MITRE ATLAS, CSA AICM. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/ThreatClassResponse"
              }
            }
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": []
      }
    },
    "/threat-model/{id}": {
      "get": {
        "summary": "Get threat class",
        "tags": [
          "Threat Model"
        ],
        "description": "Get a single threat class by ID. Returns full detail including description, severity weight, status, and external_mappings with compliance framework mappings and remediation steps. Schema: { frameworks: [{ framework, label, version, url, entries: [{ ref, title, url, remediation[] }] }] }. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/ThreatClassResponse"
            }
          },
          "404": {
            "description": "Threat class not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/aggregators": {
      "get": {
        "summary": "Get project meta data. (Deprecated)",
        "tags": [
          "Projects"
        ],
        "description": "Fetches aggregated stats for the FE. If no data is available an empty array is returned. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/ProjectAggregatorResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/organisations/{id}/aggregators": {
      "get": {
        "summary": "Get organisation meta data. (Deprecated)",
        "tags": [
          "Organisations"
        ],
        "description": "Fetches aggregated stats for the FE. If no data is available an empty array is returned. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/OrganisationAggregatorResponse"
              }
            }
          },
          "403": {
            "description": "Access is not allowed."
          },
          "404": {
            "description": "Resource not found."
          },
          "400": {
            "description": "Validation error/Bad Request"
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/assess": {
      "post": {
        "summary": "Create and run an assessment",
        "tags": [
          "Assessments"
        ],
        "description": "Create and run an assessment (campaign) for a project. Body: {\"activity\": \"assess\"|\"investigate\"|\"monitor\", \"max_test_cases\": int}. `domain` is derived from the plan and no longer accepted in the body. Only `owner` and `admin` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AssessmentCreateResponse"
            }
          },
          "400": {
            "description": "Invalid JSON body, or `domain` present in body."
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "409": {
            "description": "An assessment is already running for this project."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/object"
            }
          }
        ]
      }
    },
    "/projects/{id}/assessments": {
      "get": {
        "summary": "List assessments",
        "tags": [
          "Assessments"
        ],
        "description": "List past assessments (campaigns) for a project. Paginated. Optional `status` query param filters by exact match; default (no param) returns every assessment regardless of status. Internal test methodology fields are excluded. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AssessmentListItem"
            }
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "page",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "size",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "domain",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          },
          {
            "name": "status",
            "in": "path",
            "required": false,
            "schema": {
              "$ref": "#/definitions/str"
            }
          }
        ]
      },
      "post": {
        "summary": "Create and run a custom assessment",
        "tags": [
          "Assessments"
        ],
        "description": "Create and run a custom assessment: user-picked test categories, executed immediately (no draft/attach lifecycle). Body: {\"tests\": [\"<test_category>\", ...], \"level\": \"unit\"|\"system\"|\"acceptance\"}. `level` defaults to \"unit\" when omitted. Windowless and domain-parallel \u2014 conflicts only with a running campaign sharing a domain, or any running generated assessment. `owner`, `admin`, and `developer` levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AssessmentCreateResponse"
            }
          },
          "400": {
            "description": "Invalid tests/level, unknown or blocked test category, or project has no default integration configured."
          },
          "402": {
            "description": "Not enough credits to run this assessment."
          },
          "403": {
            "description": "Access level not permitted."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "409": {
            "description": "A conflicting assessment is already running for this project."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/object"
            }
          }
        ]
      }
    },
    "/projects/{id}/assessments/history": {
      "get": {
        "summary": "Assessment history (chart-friendly)",
        "tags": [
          "Assessments"
        ],
        "description": "Flat, chart-consumable list of completed assessments for the overview history timeline. Returns `data_points` (score, grade, started_at, completed_at, findings_discovered, domain) ordered oldest\u2192newest, plus `period_start` and `period_end` envelope fields derived from the query window. Supports `?days=N` (default 90, mirrors /posture/trends) and `?domain=security|quality`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AssessmentHistoryResponse"
            }
          },
          "403": {
            "description": "Access to this resource is not allowed."
          },
          "404": {
            "description": "Project not found or is archived."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/assessments/{aid}": {
      "get": {
        "summary": "Get assessment detail",
        "tags": [
          "Assessments"
        ],
        "description": "Get detail for a single assessment. Internal test methodology fields are excluded. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/AssessmentDetailResponse"
            }
          },
          "403": {
            "description": "Assessment does not belong to this project."
          },
          "404": {
            "description": "Project or assessment not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/assessments/{aid}/findings": {
      "get": {
        "summary": "Findings from an assessment",
        "tags": [
          "Assessments"
        ],
        "description": "Findings this assessment surfaced, attributed by evidence: a finding is listed when the assessment's experiments produced one of its evidence logs. Same shape as the project findings list, plus `is_new` \u2014 findings this run first surfaced, as opposed to re-detected. Ordered new first, then by severity. Not paginated \u2014 returns every finding for the assessment, bounded by the number of distinct threat classes. All access levels.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/AssessmentFindingItem"
              }
            }
          },
          "403": {
            "description": "Assessment does not belong to this project."
          },
          "404": {
            "description": "Project or assessment not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/assessments/{aid}/report": {
      "get": {
        "summary": "Generate assessment HTML report",
        "tags": [
          "Assessments"
        ],
        "description": "Generate a branded HTML security report for a specific assessment. Includes overview, test suite, posture before/after, findings, and full conversation appendix with multi-turn dialogue. Returns `text/html`.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "403": {
            "description": "Assessment does not belong to this project."
          },
          "404": {
            "description": "Project or assessment not found."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [
          {
            "Bearer": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "organisation_id",
            "required": true,
            "description": "Organisation id value for request validation",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          }
        ]
      }
    },
    "/projects/{id}/integrations/finding-events": {
      "post": {
        "summary": "Inbound finding state-change event",
        "tags": [
          "Integrations"
        ],
        "description": "Receive a finding state-change event from an external system (e.g. an issue tracker confirming resolution, or a CI pipeline reporting a fix). The envelope's `event_type` selects an inbound handler; the request is authenticated with the project API key (`x-api-key` header), not a JWT.",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Successful operation",
            "schema": {
              "$ref": "#/definitions/dict"
            }
          },
          "400": {
            "description": "Invalid JSON body, envelope, or unhandled event_type."
          },
          "401": {
            "description": "Invalid or missing project API key."
          },
          "404": {
            "description": "Finding not found in this project."
          },
          "500": {
            "description": "Internal server error."
          }
        },
        "security": [],
        "parameters": [
          {
            "in": "header",
            "name": "x-api-key",
            "required": true,
            "description": "From project configuration",
            "type": "string"
          },
          {
            "name": "id",
            "in": "path",
            "required": true,
            "type": "string"
          },
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/IntegrationEventEnvelope"
            }
          }
        ]
      }
    }
  },
  "tags": [
    {
      "name": "Auth"
    },
    {
      "name": "Organisations"
    },
    {
      "name": "Projects"
    },
    {
      "name": "Experiments"
    },
    {
      "name": "Firewall"
    }
  ],
  "definitions": {
    "dict": {
      "type": "object"
    },
    "str": {
      "type": "string"
    },
    "AuthResponse": {
      "properties": {
        "user": {
          "$ref": "#/definitions/UserResponse"
        },
        "access_token": {
          "title": "Access Token",
          "type": "string"
        }
      },
      "required": [
        "user",
        "access_token"
      ],
      "title": "AuthResponse",
      "type": "object"
    },
    "UserResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "username": {
          "title": "Username",
          "type": "string"
        },
        "picture": {
          "title": "Picture",
          "type": "string"
        },
        "external_id": {
          "title": "External Id",
          "type": "string"
        },
        "default_organisation_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Default Organisation Id"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "email",
        "username",
        "picture",
        "external_id",
        "default_organisation_id"
      ],
      "title": "UserResponse",
      "type": "object"
    },
    "OKMessage": {
      "properties": {
        "message": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "OK",
          "title": "Message"
        }
      },
      "title": "OKMessage",
      "type": "object"
    },
    "UnifiedScanResponse": {
      "properties": {
        "scope": {
          "title": "Scope",
          "type": "object"
        },
        "risk_profile": {
          "title": "Risk Profile",
          "type": "object"
        },
        "security_posture": {
          "default": {},
          "title": "Security Posture",
          "type": "object"
        },
        "recommendations": {
          "default": [],
          "items": {},
          "title": "Recommendations",
          "type": "array"
        },
        "default_integration": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Default Integration"
        },
        "sources_metadata": {
          "default": {},
          "title": "Sources Metadata",
          "type": "object"
        }
      },
      "required": [
        "scope",
        "risk_profile"
      ],
      "title": "UnifiedScanResponse",
      "type": "object"
    },
    "UnifiedScanRequest": {
      "properties": {
        "sources": {
          "items": {
            "$ref": "#/definitions/ScanSource"
          },
          "title": "Sources",
          "type": "array"
        }
      },
      "required": [
        "sources"
      ],
      "title": "UnifiedScanRequest",
      "type": "object"
    },
    "ScanSource": {
      "properties": {
        "source": {
          "enum": [
            "url",
            "endpoint",
            "agentic",
            "text"
          ],
          "title": "Source",
          "type": "string"
        },
        "data": {
          "title": "Data",
          "type": "object"
        }
      },
      "required": [
        "source",
        "data"
      ],
      "title": "ScanSource",
      "type": "object"
    },
    "PaginationResponse_OrganisationsResponse": {
      "properties": {
        "has_next_page": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Has Next Page"
        },
        "total": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total"
        },
        "size": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Size"
        },
        "page": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Page"
        },
        "data": {
          "default": [],
          "items": {
            "$ref": "#/definitions/OrganisationsResponse"
          },
          "title": "Data",
          "type": "array"
        }
      },
      "title": "PaginationResponse_OrganisationsResponse",
      "type": "object"
    },
    "OrganisationsResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "subscription_id": {
          "title": "Subscription Id",
          "type": "string"
        },
        "digest_frequency": {
          "title": "Digest Frequency",
          "type": "string"
        },
        "digest_last_sent_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Digest Last Sent At"
        },
        "access_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "owner",
          "title": "Access Level"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "name",
        "subscription_id",
        "digest_frequency",
        "digest_last_sent_at"
      ],
      "title": "OrganisationsResponse",
      "type": "object"
    },
    "OrganisationResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "subscription_id": {
          "title": "Subscription Id",
          "type": "string"
        },
        "digest_frequency": {
          "title": "Digest Frequency",
          "type": "string"
        },
        "digest_last_sent_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Digest Last Sent At"
        },
        "access_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "owner",
          "title": "Access Level"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "name",
        "subscription_id",
        "digest_frequency",
        "digest_last_sent_at"
      ],
      "title": "OrganisationResponse",
      "type": "object"
    },
    "OrganisationUpdate": {
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Name"
        },
        "digest_frequency": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Digest Frequency"
        },
        "digest_last_sent_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Digest Last Sent At"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "OrganisationUpdate",
      "type": "object"
    },
    "OrganisationLoginResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "access_level": {
          "title": "Access Level",
          "type": "string"
        },
        "digest_frequency": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Digest Frequency"
        },
        "digest_last_sent_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Digest Last Sent At"
        },
        "subscription": {
          "$ref": "#/definitions/SubscriptionLoginResponse"
        },
        "experiments": {
          "items": {
            "$ref": "#/definitions/ExperimentsResponse"
          },
          "title": "Experiments",
          "type": "array"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "name",
        "access_level",
        "subscription",
        "experiments"
      ],
      "title": "OrganisationLoginResponse",
      "type": "object"
    },
    "ExperimentsResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "lang": {
          "title": "Lang",
          "type": "string"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "test_category": {
          "title": "Test Category",
          "type": "string"
        },
        "datasets_used": {
          "items": {
            "type": "string"
          },
          "title": "Datasets Used",
          "type": "array"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "is_archived": {
          "title": "Is Archived",
          "type": "boolean"
        },
        "auto_start": {
          "title": "Auto Start",
          "type": "boolean"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Owner Id"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Completed At"
        },
        "campaign_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Campaign Id"
        },
        "owner_details": {
          "anyOf": [
            {
              "$ref": "#/definitions/UserCreatedExperimentResponse"
            },
            {
              "type": "null"
            }
          ],
          "as_jsonb": true,
          "default": null,
          "table_name": "Users"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "name",
        "description",
        "lang",
        "project_id",
        "test_category",
        "datasets_used",
        "status",
        "is_archived",
        "auto_start",
        "owner_id",
        "started_at",
        "completed_at"
      ],
      "title": "ExperimentsResponse",
      "type": "object"
    },
    "SubscriptionLoginResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "plan_freq": {
          "title": "Plan Freq",
          "type": "string"
        },
        "plan_freq_in_days": {
          "title": "Plan Freq In Days",
          "type": "integer"
        },
        "plan_level": {
          "title": "Plan Level",
          "type": "string"
        },
        "agreement": {
          "title": "Agreement",
          "type": "object"
        },
        "quota": {
          "title": "Quota",
          "type": "object"
        },
        "due_quota": {
          "title": "Due Quota",
          "type": "object"
        },
        "features": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Features"
        },
        "plan_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Plan Id"
        },
        "status": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Status"
        },
        "provider_customer_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Provider Customer Id"
        },
        "provider_subscription_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Provider Subscription Id"
        },
        "current_period_start": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Current Period Start"
        },
        "current_period_end": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Current Period End"
        },
        "cancel_at_period_end": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "title": "Cancel At Period End"
        },
        "scheduled_plan_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Scheduled Plan Level"
        },
        "quota_alerts": {
          "items": {
            "type": "object"
          },
          "title": "Quota Alerts",
          "type": "array"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "name",
        "plan_freq",
        "plan_freq_in_days",
        "plan_level",
        "agreement",
        "quota",
        "due_quota",
        "features",
        "plan_id",
        "status",
        "provider_customer_id",
        "provider_subscription_id",
        "current_period_start",
        "current_period_end",
        "cancel_at_period_end",
        "scheduled_plan_level",
        "quota_alerts"
      ],
      "title": "SubscriptionLoginResponse",
      "type": "object"
    },
    "UserCreatedExperimentResponse": {
      "properties": {
        "username": {
          "title": "Username",
          "type": "string"
        },
        "picture": {
          "title": "Picture",
          "type": "string"
        }
      },
      "required": [
        "username",
        "picture"
      ],
      "title": "UserCreatedExperimentResponse",
      "type": "object"
    },
    "ProjectsResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "api_key": {
          "title": "Api Key",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "is_archived": {
          "title": "Is Archived",
          "type": "boolean"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "organisation_id",
        "api_key",
        "name",
        "description",
        "is_archived"
      ],
      "title": "ProjectsResponse",
      "type": "object"
    },
    "Projects": {
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Id"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "api_key": {
          "default": "66b44e34-9b71-4a7f-a17d-f2cfb04ad495",
          "title": "Api Key",
          "type": "string"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "Untitled Project",
          "title": "Name"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Description"
        },
        "is_archived": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Is Archived"
        },
        "scope": {
          "$ref": "#/definitions/Scope"
        },
        "few_shot_framework_enabled": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Few Shot Framework Enabled"
        },
        "policy_recommendation_enabled": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": true,
          "title": "Policy Recommendation Enabled"
        },
        "policy_last_recommendation_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Last Recommendation At"
        },
        "policy_last_applied_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Last Applied At"
        },
        "policy_last_evaluated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Last Evaluated At"
        },
        "policy_last_skip_reason": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Last Skip Reason"
        },
        "last_material_change_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Material Change At"
        },
        "policy_recommendation_min_logs": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Policy Recommendation Min Logs"
        },
        "last_posture_score": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Posture Score"
        },
        "last_posture_grade": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Posture Grade"
        },
        "last_posture_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Posture At"
        },
        "ascam_drift_threshold": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": 0.15,
          "title": "Ascam Drift Threshold"
        },
        "ascam_exploratory_rate": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Ascam Exploratory Rate"
        },
        "ascam_paused": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": true,
          "title": "Ascam Paused"
        },
        "ascam_frequency": {
          "anyOf": [
            {
              "$ref": "#/definitions/ASCAMFrequency"
            },
            {
              "type": "null"
            }
          ],
          "default": "weekly"
        },
        "last_posture_dimensions": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Posture Dimensions"
        },
        "default_integration": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Default Integration"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "organisation_id",
        "scope"
      ],
      "title": "Projects",
      "type": "object"
    },
    "ASCAMFrequency": {
      "enum": [
        "daily",
        "weekly",
        "biweekly",
        "monthly"
      ],
      "title": "ASCAMFrequency",
      "type": "string"
    },
    "Capabilities": {
      "description": "Declared agentic capability surface of the target.\n\nWhen set on `Scope.capabilities`, wins over the keyword-fallback resolver\nin `_shared/capabilities.resolve_capabilities`. Drives ASCAM coverage \u2014\ne.g. tools=True enables ASI02-05 attack categories.",
      "properties": {
        "tools": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Tools"
        },
        "memory": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Memory"
        },
        "inter_agent": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Inter Agent"
        },
        "reasoning_model": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Reasoning Model"
        },
        "document_ingestion": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Document Ingestion"
        }
      },
      "title": "Capabilities",
      "type": "object"
    },
    "ListIntents": {
      "properties": {
        "permitted": {
          "items": {
            "type": "string"
          },
          "title": "Permitted",
          "type": "array"
        },
        "restricted": {
          "items": {
            "type": "string"
          },
          "title": "Restricted",
          "type": "array"
        }
      },
      "required": [
        "permitted",
        "restricted"
      ],
      "title": "ListIntents",
      "type": "object"
    },
    "RecommendedRestriction": {
      "description": "A recommended additional restriction with rationale",
      "properties": {
        "restriction": {
          "description": "The recommended restriction intent",
          "title": "Restriction",
          "type": "string"
        },
        "rationale": {
          "description": "Why this restriction is recommended for this business context",
          "title": "Rationale",
          "type": "string"
        },
        "status": {
          "default": "active",
          "description": "active | dismissed",
          "title": "Status",
          "type": "string"
        },
        "source": {
          "default": "recommended",
          "description": "recommended | learned",
          "title": "Source",
          "type": "string"
        }
      },
      "required": [
        "restriction",
        "rationale"
      ],
      "title": "RecommendedRestriction",
      "type": "object"
    },
    "Scope": {
      "properties": {
        "overall_business_scope": {
          "maxLength": 5000,
          "minLength": 20,
          "title": "Overall Business Scope",
          "type": "string"
        },
        "intents": {
          "$ref": "#/definitions/ListIntents"
        },
        "more_info": {
          "anyOf": [
            {
              "maxLength": 200,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "More Info"
        },
        "recommended_additional_restrictions": {
          "anyOf": [
            {
              "items": {
                "$ref": "#/definitions/RecommendedRestriction"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Additional security restrictions recommended based on business scope and risk profile",
          "title": "Recommended Additional Restrictions"
        },
        "capabilities": {
          "anyOf": [
            {
              "$ref": "#/definitions/Capabilities"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "User-declared agentic capability surface (tools/memory/inter_agent/reasoning_model)"
        }
      },
      "required": [
        "overall_business_scope",
        "intents"
      ],
      "title": "Scope",
      "type": "object"
    },
    "PaginationResponse_ProjectsResponse": {
      "properties": {
        "has_next_page": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Has Next Page"
        },
        "total": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total"
        },
        "size": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Size"
        },
        "page": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Page"
        },
        "data": {
          "default": [],
          "items": {
            "$ref": "#/definitions/ProjectsResponse"
          },
          "title": "Data",
          "type": "array"
        }
      },
      "title": "PaginationResponse_ProjectsResponse",
      "type": "object"
    },
    "ProjectUpdate": {
      "description": "Public update schema \u2014 fields a user is allowed to set via PUT /projects/{id}.\n\nPlatform-managed fields (last_posture_*, policy_last_*) live on\nProjectInternalUpdate so they cannot be written through the public API.",
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "api_key": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Api Key"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Name"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Description"
        },
        "is_archived": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Is Archived"
        },
        "scope": {
          "anyOf": [
            {
              "$ref": "#/definitions/Scope"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "few_shot_framework_enabled": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Few Shot Framework Enabled"
        },
        "policy_recommendation_enabled": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Recommendation Enabled"
        },
        "policy_recommendation_min_logs": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Policy Recommendation Min Logs"
        },
        "ascam_drift_threshold": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Ascam Drift Threshold"
        },
        "ascam_exploratory_rate": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Ascam Exploratory Rate"
        },
        "ascam_paused": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Ascam Paused"
        },
        "ascam_frequency": {
          "anyOf": [
            {
              "$ref": "#/definitions/ASCAMFrequency"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "default_integration": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Default Integration"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "ProjectUpdate",
      "type": "object"
    },
    "ProjectAnalyseRequest": {
      "properties": {
        "data": {
          "maxLength": 6000,
          "minLength": 50,
          "title": "Data",
          "type": "string"
        }
      },
      "required": [
        "data"
      ],
      "title": "ProjectAnalyseRequest",
      "type": "object"
    },
    "AgenticConfig": {
      "properties": {
        "instructions": {
          "title": "Instructions",
          "type": "string"
        },
        "tools": {
          "anyOf": [
            {
              "items": {
                "$ref": "#/definitions/ToolDefinition"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": [],
          "title": "Tools"
        }
      },
      "required": [
        "instructions"
      ],
      "title": "AgenticConfig",
      "type": "object"
    },
    "ToolDefinition": {
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "type": {
          "title": "Type",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "mock_response": {
          "title": "Mock Response",
          "type": "string"
        },
        "parameters": {
          "items": {
            "$ref": "#/definitions/ToolParam"
          },
          "title": "Parameters",
          "type": "array"
        },
        "enabled": {
          "default": true,
          "title": "Enabled",
          "type": "boolean"
        }
      },
      "required": [
        "name",
        "type",
        "description",
        "mock_response"
      ],
      "title": "ToolDefinition",
      "type": "object"
    },
    "ToolParam": {
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "type": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "Any",
          "title": "Type"
        }
      },
      "required": [
        "name"
      ],
      "title": "ToolParam",
      "type": "object"
    },
    "PaginationResponse_Logs": {
      "properties": {
        "has_next_page": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Has Next Page"
        },
        "total": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total"
        },
        "size": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Size"
        },
        "page": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Page"
        },
        "data": {
          "default": [],
          "items": {
            "$ref": "#/definitions/LogsResponse"
          },
          "title": "Data",
          "type": "array"
        }
      },
      "title": "PaginationResponse_Logs",
      "type": "object"
    },
    "Feedback": {
      "properties": {
        "label": {
          "$ref": "#/definitions/FeedbackLabels"
        },
        "comments": {
          "anyOf": [
            {
              "maxLength": 150,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Comments"
        }
      },
      "required": [
        "label",
        "comments"
      ],
      "title": "Feedback",
      "type": "object"
    },
    "FeedbackLabels": {
      "enum": [
        "confirm",
        "pass",
        "fail_low_severity",
        "fail_medium_severity",
        "fail_high_severity"
      ],
      "title": "FeedbackLabels",
      "type": "string"
    },
    "LogsResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "experiment_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Experiment Id"
        },
        "thread_id": {
          "title": "Thread Id",
          "type": "string"
        },
        "conversation": {
          "items": {
            "$ref": "#/definitions/Turn"
          },
          "title": "Conversation",
          "type": "array"
        },
        "prompt": {
          "title": "Prompt",
          "type": "string"
        },
        "response": {
          "title": "Response",
          "type": "string"
        },
        "result": {
          "title": "Result",
          "type": "string"
        },
        "severity": {
          "title": "Severity",
          "type": "number"
        },
        "confidence": {
          "title": "Confidence",
          "type": "number"
        },
        "gen_category": {
          "title": "Gen Category",
          "type": "string"
        },
        "fail_category": {
          "title": "Fail Category",
          "type": "string"
        },
        "explanation": {
          "title": "Explanation",
          "type": "string"
        },
        "feedback": {
          "anyOf": [
            {
              "$ref": "#/definitions/Feedback"
            },
            {
              "type": "null"
            }
          ]
        },
        "threat_class": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Threat Class"
        },
        "severity_label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Severity Label"
        },
        "is_representative": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "title": "Is Representative"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "project_id",
        "experiment_id",
        "thread_id",
        "conversation",
        "prompt",
        "response",
        "result",
        "severity",
        "confidence",
        "gen_category",
        "fail_category",
        "explanation",
        "feedback",
        "threat_class",
        "severity_label",
        "is_representative"
      ],
      "title": "LogsResponse",
      "type": "object"
    },
    "Turn": {
      "properties": {
        "u": {
          "title": "U",
          "type": "string"
        },
        "a": {
          "title": "A",
          "type": "string"
        }
      },
      "required": [
        "u",
        "a"
      ],
      "title": "Turn",
      "type": "object"
    },
    "ProjectPosture": {
      "description": "Project-level posture aggregated from experiments + finding penalty.\n\nComputed on the fly (cached in Redis). Returned by GET /projects/{id}/posture.",
      "properties": {
        "posture": {
          "default": 0.0,
          "title": "Posture",
          "type": "number"
        },
        "grade": {
          "default": "F",
          "title": "Grade",
          "type": "string"
        },
        "dimensions": {
          "anyOf": [
            {
              "$ref": "#/definitions/PostureDimensions"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "stale": {
          "default": false,
          "title": "Stale",
          "type": "boolean"
        },
        "evaluated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Evaluated At"
        },
        "findings": {
          "anyOf": [
            {
              "$ref": "#/definitions/FindingsSummary"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "ProjectPosture",
      "type": "object"
    },
    "FindingsSummary": {
      "description": "Findings stats \u2014 used at dimension, project, and org level.",
      "properties": {
        "open": {
          "default": 0,
          "title": "Open",
          "type": "integer"
        },
        "critical": {
          "default": 0,
          "title": "Critical",
          "type": "integer"
        },
        "high": {
          "default": 0,
          "title": "High",
          "type": "integer"
        },
        "regressed": {
          "default": 0,
          "title": "Regressed",
          "type": "integer"
        }
      },
      "title": "FindingsSummary",
      "type": "object"
    },
    "PostureDimension": {
      "description": "Score for a single dimension (security or quality).",
      "properties": {
        "posture": {
          "default": 0.0,
          "title": "Posture",
          "type": "number"
        },
        "grade": {
          "default": "F",
          "title": "Grade",
          "type": "string"
        },
        "findings": {
          "anyOf": [
            {
              "$ref": "#/definitions/FindingsSummary"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "PostureDimension",
      "type": "object"
    },
    "PostureDimensions": {
      "description": "Container for dimension-level posture scores.",
      "properties": {
        "security": {
          "anyOf": [
            {
              "$ref": "#/definitions/PostureDimension"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "quality": {
          "anyOf": [
            {
              "$ref": "#/definitions/PostureDimension"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "PostureDimensions",
      "type": "object"
    },
    "PostureTrendsResponse": {
      "description": "Response for GET /projects/{id}/posture/trends and org-level equivalent.",
      "properties": {
        "data_points": {
          "default": [],
          "items": {
            "$ref": "#/definitions/PostureTrendDataPoint"
          },
          "title": "Data Points",
          "type": "array"
        },
        "trend": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Trend"
        },
        "score_delta": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Score Delta"
        },
        "period_start": {
          "default": "",
          "title": "Period Start",
          "type": "string"
        },
        "period_end": {
          "default": "",
          "title": "Period End",
          "type": "string"
        },
        "granularity": {
          "default": "raw",
          "title": "Granularity",
          "type": "string"
        },
        "total_snapshots": {
          "default": 0,
          "title": "Total Snapshots",
          "type": "integer"
        }
      },
      "title": "PostureTrendsResponse",
      "type": "object"
    },
    "PostureTrendDataPoint": {
      "description": "Single data point in a posture trend.",
      "properties": {
        "bucket": {
          "title": "Bucket",
          "type": "string"
        },
        "avg_score": {
          "title": "Avg Score",
          "type": "number"
        },
        "min_score": {
          "title": "Min Score",
          "type": "number"
        },
        "max_score": {
          "title": "Max Score",
          "type": "number"
        },
        "grade": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Grade"
        },
        "snapshot_count": {
          "default": 0,
          "title": "Snapshot Count",
          "type": "integer"
        },
        "risk_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Risk Level"
        },
        "risk_level_score": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Risk Level Score"
        },
        "project_count": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Project Count"
        }
      },
      "required": [
        "bucket",
        "avg_score",
        "min_score",
        "max_score"
      ],
      "title": "PostureTrendDataPoint",
      "type": "object"
    },
    "FindingsResponse": {
      "description": "API response schema",
      "properties": {
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "domain": {
          "title": "Domain",
          "type": "string"
        },
        "title": {
          "title": "Title",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "category": {
          "title": "Category",
          "type": "string"
        },
        "threat_class": {
          "title": "Threat Class",
          "type": "string"
        },
        "severity_label": {
          "title": "Severity Label",
          "type": "string"
        },
        "severity": {
          "title": "Severity",
          "type": "number"
        },
        "confidence": {
          "title": "Confidence",
          "type": "number"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "id": {
          "title": "Id",
          "type": "string"
        },
        "occurrence_count": {
          "title": "Occurrence Count",
          "type": "integer"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "first_seen_at": {
          "title": "First Seen At",
          "type": "number"
        },
        "last_seen_at": {
          "title": "Last Seen At",
          "type": "number"
        },
        "fixed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Fixed At"
        },
        "log_ids": {
          "items": {
            "type": "string"
          },
          "title": "Log Ids",
          "type": "array"
        },
        "representative_log_ids": {
          "items": {
            "type": "string"
          },
          "title": "Representative Log Ids",
          "type": "array"
        },
        "assignee_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Assignee Id"
        },
        "delegation_status": {
          "title": "Delegation Status",
          "type": "string"
        },
        "delegated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Delegated At"
        },
        "last_regression": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Last Regression"
        }
      },
      "required": [
        "project_id",
        "domain",
        "title",
        "description",
        "category",
        "threat_class",
        "severity_label",
        "severity",
        "confidence",
        "status",
        "id",
        "occurrence_count",
        "created_at",
        "updated_at",
        "first_seen_at",
        "last_seen_at",
        "log_ids",
        "representative_log_ids",
        "assignee_id",
        "delegation_status",
        "delegated_at",
        "last_regression"
      ],
      "title": "FindingsResponse",
      "type": "object"
    },
    "FindingsUpdate": {
      "description": "Schema for updating finding",
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/definitions/FindingStatus"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "severity_label": {
          "anyOf": [
            {
              "$ref": "#/definitions/FindingSeverity"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Description"
        },
        "threat_class": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Threat Class"
        },
        "last_seen_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Seen At"
        },
        "occurrence_count": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Occurrence Count"
        },
        "log_ids": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Log Ids"
        },
        "representative_log_ids": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Representative Log Ids"
        },
        "fixed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Fixed At"
        },
        "assignee_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Assignee Id"
        },
        "delegation_status": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Delegation Status"
        },
        "delegated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Delegated At"
        },
        "resolution_method": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Resolution Method"
        },
        "last_regression": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Regression"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "FindingsUpdate",
      "type": "object"
    },
    "FindingSeverity": {
      "description": "Severity levels",
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "info"
      ],
      "title": "FindingSeverity",
      "type": "string"
    },
    "FindingStatus": {
      "description": "Finding lifecycle states",
      "enum": [
        "open",
        "stale",
        "fixed",
        "regressed"
      ],
      "title": "FindingStatus",
      "type": "string"
    },
    "CoverageWithGapsResponse": {
      "description": "Response for GET /projects/{id}/coverage?include_gaps=true.",
      "properties": {
        "project_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Project Id"
        },
        "total_categories": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Total Categories"
        },
        "tested_categories": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Tested Categories"
        },
        "coverage_percentage": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Coverage Percentage"
        },
        "total_tests": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Total Tests"
        },
        "total_pass": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Total Pass"
        },
        "total_fail": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Total Fail"
        },
        "pass_rate": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Pass Rate"
        },
        "by_category": {
          "anyOf": [
            {
              "additionalProperties": {
                "type": "object"
              },
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "By Category"
        },
        "gaps": {
          "default": [],
          "items": {
            "$ref": "#/definitions/CoverageGapItem"
          },
          "title": "Gaps",
          "type": "array"
        }
      },
      "title": "CoverageWithGapsResponse",
      "type": "object"
    },
    "CoverageGapItem": {
      "description": "Single coverage gap entry.",
      "properties": {
        "category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Category"
        },
        "subcategory": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Subcategory"
        },
        "threat_class": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Threat Class"
        },
        "reason": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Reason"
        },
        "last_tested_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Tested At"
        },
        "priority": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Priority"
        }
      },
      "title": "CoverageGapItem",
      "type": "object"
    },
    "PolicyRecommendationResponse": {
      "description": "API response schema",
      "properties": {
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "analysis_window_start": {
          "title": "Analysis Window Start",
          "type": "number"
        },
        "analysis_window_end": {
          "title": "Analysis Window End",
          "type": "number"
        },
        "analyzed_log_count": {
          "title": "Analyzed Log Count",
          "type": "integer"
        },
        "analyzed_experiment_ids": {
          "items": {
            "type": "string"
          },
          "title": "Analyzed Experiment Ids",
          "type": "array"
        },
        "confidence_score": {
          "title": "Confidence Score",
          "type": "number"
        },
        "confidence_breakdown": {
          "title": "Confidence Breakdown",
          "type": "object"
        },
        "previous_scope": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Previous Scope"
        },
        "recommendation_data": {
          "title": "Recommendation Data",
          "type": "object"
        },
        "risk_patterns": {
          "items": {
            "type": "object"
          },
          "title": "Risk Patterns",
          "type": "array"
        },
        "permission_gaps": {
          "items": {
            "type": "object"
          },
          "title": "Permission Gaps",
          "type": "array"
        },
        "source_finding_ids": {
          "items": {
            "type": "string"
          },
          "title": "Source Finding Ids",
          "type": "array"
        },
        "changes_summary": {
          "title": "Changes Summary",
          "type": "object"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "id": {
          "title": "Id",
          "type": "string"
        },
        "accepted_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Accepted At"
        },
        "accepted_by": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Accepted By"
        },
        "rejected_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Rejected At"
        },
        "rejected_by": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Rejected By"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        }
      },
      "required": [
        "project_id",
        "analysis_window_start",
        "analysis_window_end",
        "analyzed_log_count",
        "analyzed_experiment_ids",
        "confidence_score",
        "confidence_breakdown",
        "previous_scope",
        "recommendation_data",
        "risk_patterns",
        "permission_gaps",
        "source_finding_ids",
        "changes_summary",
        "status",
        "id",
        "created_at",
        "updated_at"
      ],
      "title": "PolicyRecommendationResponse",
      "type": "object"
    },
    "ConversationUploadResponse": {
      "description": "Response for successful conversation upload.",
      "properties": {
        "dataset_id": {
          "title": "Dataset Id",
          "type": "string"
        },
        "test_category": {
          "title": "Test Category",
          "type": "string"
        },
        "count": {
          "title": "Count",
          "type": "integer"
        }
      },
      "required": [
        "dataset_id",
        "test_category",
        "count"
      ],
      "title": "ConversationUploadResponse",
      "type": "object"
    },
    "ConversationUploadRequest": {
      "description": "Request body for uploading conversation logs.\n\nTwo modes:\n- Normalized: conversations contains Turn data (no source field)\n- Raw import: source + conversations contains raw JSONL entries from AI tools",
      "properties": {
        "tag": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Tag"
        },
        "conversations": {
          "items": {},
          "title": "Conversations",
          "type": "array"
        },
        "source": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Source"
        },
        "lang": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "Agnostic",
          "title": "Lang"
        },
        "testing_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "production",
          "title": "Testing Level"
        }
      },
      "required": [
        "conversations"
      ],
      "title": "ConversationUploadRequest",
      "type": "object"
    },
    "Experiments": {
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Id"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "Untitled Experiment",
          "title": "Name"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Description"
        },
        "configuration": {
          "$ref": "#/definitions/Configuration"
        },
        "test_category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "humanbound/adversarial/autonomous_red_team",
          "title": "Test Category"
        },
        "datasets_used": {
          "default": [],
          "items": {
            "type": "string"
          },
          "title": "Datasets Used",
          "type": "array"
        },
        "status": {
          "$ref": "#/definitions/Status"
        },
        "results": {
          "$ref": "#/definitions/Results",
          "default": {
            "stats": {
              "fail": 0,
              "fail_impact": 0.0,
              "pass": 0,
              "reliability": 0.0,
              "total": 0,
              "total_perfomance_index": 0.0
            },
            "tests": {},
            "exec_t": {
              "avg_t": 0.0,
              "max_t": 0.0,
              "min_t": 0.0
            },
            "insights": [],
            "posture": null,
            "regression": null
          }
        },
        "nonce": {
          "title": "Nonce",
          "type": "string"
        },
        "lang": {
          "title": "Lang",
          "type": "string"
        },
        "is_archived": {
          "default": false,
          "title": "Is Archived",
          "type": "boolean"
        },
        "testing_level": {
          "anyOf": [
            {
              "$ref": "#/definitions/TestingLevel"
            },
            {
              "type": "null"
            }
          ],
          "default": "unit"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Owner Id"
        },
        "task_meta_info": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Task Meta Info"
        },
        "auto_start": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": true,
          "title": "Auto Start"
        },
        "few_shot_training_pending": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Few Shot Training Pending"
        },
        "campaign_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Campaign Id"
        },
        "finding_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Finding Id"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Completed At"
        },
        "orchestrator_state": {
          "$ref": "#/definitions/OrchestratorState",
          "default": {
            "seed_analysis": {},
            "active_sessions": {},
            "completed_at": null
          }
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "project_id",
        "configuration",
        "status",
        "nonce",
        "lang"
      ],
      "title": "Experiments",
      "type": "object"
    },
    "AuditorConfiguration": {
      "description": "Configuration for logs_auditor orchestrator.",
      "properties": {
        "parent": {
          "title": "Parent",
          "type": "string"
        }
      },
      "required": [
        "parent"
      ],
      "title": "AuditorConfiguration",
      "type": "object"
    },
    "ClientBotAuthEndpoint": {
      "properties": {
        "endpoint": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Endpoint"
        },
        "headers": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Headers"
        },
        "payload": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Payload"
        }
      },
      "title": "ClientBotAuthEndpoint",
      "type": "object"
    },
    "ClientBotConfiguration": {
      "properties": {
        "streaming": {
          "anyOf": [
            {
              "enum": [
                "websocket",
                "sse"
              ],
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Streaming"
        },
        "thread_auth": {
          "anyOf": [
            {
              "$ref": "#/definitions/ClientBotAuthEndpoint"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "thread_init": {
          "anyOf": [
            {
              "$ref": "#/definitions/ClientBotEndpoints"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "chat_completion": {
          "anyOf": [
            {
              "$ref": "#/definitions/ClientBotEndpoints"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "connector": {
          "anyOf": [
            {
              "$ref": "#/definitions/ConnectorBlock"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "telemetry": {
          "anyOf": [
            {
              "$ref": "#/definitions/TelemetryConfiguration"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "ClientBotConfiguration",
      "type": "object"
    },
    "ClientBotEndpoints": {
      "properties": {
        "endpoint": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Endpoint"
        },
        "headers": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Headers"
        },
        "payload": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "items": {},
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Payload"
        }
      },
      "title": "ClientBotEndpoints",
      "type": "object"
    },
    "Configuration": {
      "properties": {
        "integration": {
          "anyOf": [
            {
              "$ref": "#/definitions/ClientBotConfiguration"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "scope": {
          "anyOf": [
            {
              "$ref": "#/definitions/Scope"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "context": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Context"
        },
        "auditor": {
          "anyOf": [
            {
              "$ref": "#/definitions/AuditorConfiguration"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "regression": {
          "anyOf": [
            {
              "$ref": "#/definitions/RegressionConfiguration"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "Configuration",
      "type": "object"
    },
    "ConnectorBlock": {
      "properties": {
        "provider": {
          "title": "Provider",
          "type": "string"
        },
        "config": {
          "title": "Config",
          "type": "object"
        }
      },
      "required": [
        "provider",
        "config"
      ],
      "title": "ConnectorBlock",
      "type": "object"
    },
    "ExecT": {
      "properties": {
        "max_t": {
          "default": 0,
          "title": "Max T",
          "type": "number"
        },
        "min_t": {
          "default": 0,
          "title": "Min T",
          "type": "number"
        },
        "avg_t": {
          "default": 0,
          "title": "Avg T",
          "type": "number"
        }
      },
      "title": "ExecT",
      "type": "object"
    },
    "ExperimentPosture": {
      "description": "Experiment-level posture computed from ASR and eval metrics.\n\nStored in Experiment.results.posture after summarize. Only carries the\nscore/grade/dimensions that downstream consumers (report, project rollup)\nactually read; intermediate compute values (defense_rate, breach lists,\nconfidence, etc.) are derived inside the presenter and discarded.",
      "properties": {
        "posture": {
          "default": 0.0,
          "title": "Posture",
          "type": "number"
        },
        "grade": {
          "default": "F",
          "title": "Grade",
          "type": "string"
        },
        "dimensions": {
          "anyOf": [
            {
              "$ref": "#/definitions/PostureDimensions"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "title": "ExperimentPosture",
      "type": "object"
    },
    "Insight": {
      "properties": {
        "result": {
          "title": "Result",
          "type": "string"
        },
        "category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Category"
        },
        "severity": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Severity"
        },
        "explanation": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Explanation"
        },
        "examples": {
          "anyOf": [
            {
              "items": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "$ref": "#/definitions/LogsResponse"
                  }
                ]
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": [],
          "title": "Examples"
        }
      },
      "required": [
        "result"
      ],
      "title": "Insight",
      "type": "object"
    },
    "OrchestratorState": {
      "additionalProperties": true,
      "description": "Orchestrator-internal state persisted between API calls.\n\nStored as JSONB. json_agg double-encodes JSONB columns, so the\nmodel_validator parses the JSON string on construction \u2014 same\npattern as Configuration and Results.",
      "properties": {
        "seed_analysis": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Seed Analysis"
        },
        "active_sessions": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Active Sessions"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Completed At"
        }
      },
      "title": "OrchestratorState",
      "type": "object"
    },
    "RegressionConfiguration": {
      "description": "Config for the _regression meta-orchestrator: verify one finding.",
      "properties": {
        "finding_id": {
          "title": "Finding Id",
          "type": "string"
        },
        "testing_level": {
          "$ref": "#/definitions/TestingLevel",
          "default": "unit"
        }
      },
      "required": [
        "finding_id"
      ],
      "title": "RegressionConfiguration",
      "type": "object"
    },
    "Results": {
      "properties": {
        "stats": {
          "$ref": "#/definitions/Stats",
          "default": {
            "reliability": 0.0,
            "pass": 0,
            "fail": 0,
            "total": 0,
            "fail_impact": 0.0,
            "total_perfomance_index": 0.0
          }
        },
        "tests": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "$ref": "#/definitions/TestsStats"
            }
          ],
          "default": {},
          "title": "Tests"
        },
        "exec_t": {
          "$ref": "#/definitions/ExecT",
          "default": {
            "max_t": 0.0,
            "min_t": 0.0,
            "avg_t": 0.0
          }
        },
        "insights": {
          "default": [],
          "items": {
            "$ref": "#/definitions/Insight"
          },
          "title": "Insights",
          "type": "array"
        },
        "posture": {
          "anyOf": [
            {
              "$ref": "#/definitions/ExperimentPosture"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "regression": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Regression"
        }
      },
      "title": "Results",
      "type": "object"
    },
    "Stats": {
      "properties": {
        "reliability": {
          "default": 0,
          "title": "Reliability",
          "type": "number"
        },
        "pass": {
          "default": 0,
          "title": "Pass",
          "type": "integer"
        },
        "fail": {
          "default": 0,
          "title": "Fail",
          "type": "integer"
        },
        "total": {
          "default": 0,
          "title": "Total",
          "type": "integer"
        },
        "fail_impact": {
          "default": 0,
          "title": "Fail Impact",
          "type": "number"
        },
        "total_perfomance_index": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total Perfomance Index"
        }
      },
      "title": "Stats",
      "type": "object"
    },
    "Status": {
      "enum": [
        "Created",
        "Generating Dataset",
        "Dataset Generated",
        "Running",
        "Completed",
        "Analysing Results",
        "Finished",
        "Failed"
      ],
      "title": "Status",
      "type": "string"
    },
    "TelemetryConfiguration": {
      "description": "Whitebox telemetry config \u2014 allows judge to see tool calls, memory ops, etc.\nPresence of this block = telemetry is enabled (no separate flag).",
      "properties": {
        "endpoint": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Endpoint"
        },
        "headers": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Headers"
        },
        "payload": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": {},
          "title": "Payload"
        },
        "mode": {
          "default": "end_of_conversation",
          "title": "Mode",
          "type": "string"
        },
        "format": {
          "default": "custom",
          "title": "Format",
          "type": "string"
        },
        "telemetry_auth": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Telemetry Auth"
        },
        "extraction_map": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Extraction Map"
        }
      },
      "title": "TelemetryConfiguration",
      "type": "object"
    },
    "TestingLevel": {
      "enum": [
        "unit",
        "system",
        "acceptance",
        "production"
      ],
      "title": "TestingLevel",
      "type": "string"
    },
    "TestsStats": {
      "properties": {
        "data": {
          "title": "Data",
          "type": "object"
        },
        "evals": {
          "title": "Evals",
          "type": "object"
        }
      },
      "required": [
        "data",
        "evals"
      ],
      "title": "TestsStats",
      "type": "object"
    },
    "PaginationResponse_ExperimentsResponse": {
      "properties": {
        "has_next_page": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Has Next Page"
        },
        "total": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total"
        },
        "size": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Size"
        },
        "page": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Page"
        },
        "data": {
          "default": [],
          "items": {
            "$ref": "#/definitions/ExperimentsResponse"
          },
          "title": "Data",
          "type": "array"
        }
      },
      "title": "PaginationResponse_ExperimentsResponse",
      "type": "object"
    },
    "ExperimentAugmentedResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "configuration": {
          "$ref": "#/definitions/Configuration"
        },
        "test_category": {
          "title": "Test Category",
          "type": "string"
        },
        "datasets_used": {
          "items": {
            "type": "string"
          },
          "title": "Datasets Used",
          "type": "array"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "results": {
          "$ref": "#/definitions/Results"
        },
        "lang": {
          "title": "Lang",
          "type": "string"
        },
        "is_archived": {
          "title": "Is Archived",
          "type": "boolean"
        },
        "testing_level": {
          "title": "Testing Level",
          "type": "string"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Owner Id"
        },
        "auto_start": {
          "title": "Auto Start",
          "type": "boolean"
        },
        "campaign_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Campaign Id"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Completed At"
        },
        "orchestrator_state": {
          "$ref": "#/definitions/OrchestratorState",
          "default": {
            "seed_analysis": {},
            "active_sessions": {},
            "completed_at": null
          }
        },
        "owner_details": {
          "anyOf": [
            {
              "$ref": "#/definitions/UserCreatedExperimentResponse"
            },
            {
              "type": "null"
            }
          ],
          "as_jsonb": true,
          "table_name": "Users"
        },
        "schemas": {
          "$ref": "#/definitions/ExeprimentMetaSchemas"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "project_id",
        "name",
        "description",
        "configuration",
        "test_category",
        "datasets_used",
        "status",
        "results",
        "lang",
        "is_archived",
        "testing_level",
        "owner_id",
        "auto_start",
        "campaign_id",
        "started_at",
        "completed_at",
        "owner_details",
        "schemas"
      ],
      "title": "ExperimentAugmentedResponse",
      "type": "object"
    },
    "ExeprimentMetaSchemas": {
      "properties": {
        "data": {
          "items": {
            "type": "string"
          },
          "title": "Data",
          "type": "array"
        },
        "evals": {
          "items": {
            "type": "string"
          },
          "title": "Evals",
          "type": "array"
        }
      },
      "required": [
        "data",
        "evals"
      ],
      "title": "ExeprimentMetaSchemas",
      "type": "object"
    },
    "ExperimentsResponseStatus": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "is_archived": {
          "title": "Is Archived",
          "type": "boolean"
        },
        "auto_start": {
          "title": "Auto Start",
          "type": "boolean"
        },
        "log_count": {
          "default": 0,
          "title": "Log Count",
          "type": "integer"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "project_id",
        "status",
        "is_archived",
        "auto_start"
      ],
      "title": "ExperimentsResponseStatus",
      "type": "object"
    },
    "ExperimentPublicUpdate": {
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Name"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Description"
        },
        "is_archived": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Is Archived"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "ExperimentPublicUpdate",
      "type": "object"
    },
    "RecommendedScope": {
      "properties": {
        "overall_business_scope": {
          "maxLength": 5000,
          "minLength": 20,
          "title": "Overall Business Scope",
          "type": "string"
        },
        "intents": {
          "$ref": "#/definitions/ListIntents"
        },
        "more_info": {
          "anyOf": [
            {
              "maxLength": 200,
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "More Info"
        },
        "recommended_additional_restrictions": {
          "anyOf": [
            {
              "items": {
                "$ref": "#/definitions/RecommendedRestriction"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Additional security restrictions recommended based on business scope and risk profile",
          "title": "Recommended Additional Restrictions"
        },
        "capabilities": {
          "anyOf": [
            {
              "$ref": "#/definitions/Capabilities"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "User-declared agentic capability surface (tools/memory/inter_agent/reasoning_model)"
        },
        "recommended_prompt": {
          "title": "Recommended Prompt",
          "type": "string"
        }
      },
      "required": [
        "overall_business_scope",
        "intents",
        "recommended_prompt"
      ],
      "title": "RecommendedScope",
      "type": "object"
    },
    "FlaggedForReviewResponse": {
      "description": "Response for GET /experiments/{id}/flagged-for-review.",
      "properties": {
        "total_flagged": {
          "default": 0,
          "title": "Total Flagged",
          "type": "integer"
        },
        "potential_impact": {
          "anyOf": [
            {
              "$ref": "#/definitions/FlaggedImpact"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "groups": {
          "default": [],
          "items": {
            "$ref": "#/definitions/FlaggedGroup"
          },
          "title": "Groups",
          "type": "array"
        }
      },
      "title": "FlaggedForReviewResponse",
      "type": "object"
    },
    "FlaggedGroup": {
      "description": "A group of logs sharing the same representative correction.",
      "properties": {
        "representative_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Representative Id"
        },
        "original_verdict": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Original Verdict"
        },
        "feedback_label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Feedback Label"
        },
        "suggested_verdict": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Suggested Verdict"
        },
        "affected_logs": {
          "default": [],
          "items": {
            "$ref": "#/definitions/FlaggedLogEntry"
          },
          "title": "Affected Logs",
          "type": "array"
        }
      },
      "title": "FlaggedGroup",
      "type": "object"
    },
    "FlaggedImpact": {
      "description": "Impact summary for flagged-for-review logs.",
      "properties": {
        "pass_to_fail": {
          "default": 0,
          "title": "Pass To Fail",
          "type": "integer"
        },
        "fail_to_pass": {
          "default": 0,
          "title": "Fail To Pass",
          "type": "integer"
        },
        "message": {
          "default": "",
          "title": "Message",
          "type": "string"
        }
      },
      "title": "FlaggedImpact",
      "type": "object"
    },
    "FlaggedLogEntry": {
      "description": "Single log entry flagged for review.",
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Id"
        },
        "thread_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Thread Id"
        },
        "result": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Result"
        },
        "severity": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Severity"
        },
        "confidence": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Confidence"
        },
        "gen_category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Gen Category"
        },
        "fail_category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Fail Category"
        }
      },
      "title": "FlaggedLogEntry",
      "type": "object"
    },
    "FirewallResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "explanation": {
          "title": "Explanation",
          "type": "string"
        },
        "exec_t": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Exec T"
        }
      },
      "required": [
        "id",
        "explanation"
      ],
      "title": "FirewallResponse",
      "type": "object"
    },
    "Firewall": {
      "properties": {
        "messages": {
          "items": {
            "$ref": "#/definitions/Message"
          },
          "title": "Messages",
          "type": "array"
        },
        "timeout": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Timeout"
        }
      },
      "required": [
        "messages"
      ],
      "title": "Firewall",
      "type": "object"
    },
    "Message": {
      "properties": {
        "role": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "user",
          "title": "Role"
        },
        "content": {
          "maxLength": 2000,
          "title": "Content",
          "type": "string"
        }
      },
      "required": [
        "content"
      ],
      "title": "Message",
      "type": "object"
    },
    "FirewallEval": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "conversation": {
          "items": {
            "$ref": "#/definitions/Turn"
          },
          "title": "Conversation",
          "type": "array"
        },
        "result": {
          "title": "Result",
          "type": "string"
        },
        "fail_category": {
          "title": "Fail Category",
          "type": "string"
        },
        "explanation": {
          "title": "Explanation",
          "type": "string"
        },
        "severity": {
          "title": "Severity",
          "type": "number"
        },
        "confidence": {
          "title": "Confidence",
          "type": "number"
        },
        "feedback": {
          "anyOf": [
            {
              "$ref": "#/definitions/Feedback"
            },
            {
              "type": "null"
            }
          ]
        },
        "exec_t": {
          "title": "Exec T",
          "type": "number"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "conversation",
        "result",
        "fail_category",
        "explanation",
        "severity",
        "confidence",
        "feedback",
        "exec_t"
      ],
      "title": "FirewallEval",
      "type": "object"
    },
    "Providers": {
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Id"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "integration": {
          "title": "Integration",
          "type": "object"
        },
        "is_default": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Is Default"
        },
        "is_managed": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Is Managed"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "organisation_id",
        "name",
        "integration"
      ],
      "title": "Providers",
      "type": "object"
    },
    "ProvidersResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "integration": {
          "title": "Integration",
          "type": "object"
        },
        "is_default": {
          "title": "Is Default",
          "type": "boolean"
        },
        "is_managed": {
          "title": "Is Managed",
          "type": "boolean"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "name",
        "integration",
        "is_default",
        "is_managed"
      ],
      "title": "ProvidersResponse",
      "type": "object"
    },
    "LogResponse": {
      "description": "API-facing response model \u2014 excludes internal fields (GCI-4).",
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "project_id": {
          "title": "Project Id",
          "type": "string"
        },
        "experiment_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Experiment Id"
        },
        "thread_id": {
          "title": "Thread Id",
          "type": "string"
        },
        "conversation": {
          "items": {
            "$ref": "#/definitions/Turn"
          },
          "title": "Conversation",
          "type": "array"
        },
        "prompt": {
          "title": "Prompt",
          "type": "string"
        },
        "response": {
          "title": "Response",
          "type": "string"
        },
        "result": {
          "title": "Result",
          "type": "string"
        },
        "gen_category": {
          "title": "Gen Category",
          "type": "string"
        },
        "fail_category": {
          "title": "Fail Category",
          "type": "string"
        },
        "explanation": {
          "title": "Explanation",
          "type": "string"
        },
        "severity": {
          "title": "Severity",
          "type": "number"
        },
        "confidence": {
          "title": "Confidence",
          "type": "number"
        },
        "meta": {
          "default": {},
          "title": "Meta",
          "type": "object"
        },
        "eval_breakdown": {
          "default": [],
          "items": {
            "type": "object"
          },
          "title": "Eval Breakdown",
          "type": "array"
        },
        "exec_t": {
          "title": "Exec T",
          "type": "number"
        },
        "feedback": {
          "anyOf": [
            {
              "$ref": "#/definitions/Feedback"
            },
            {
              "type": "null"
            }
          ]
        },
        "representative_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Representative Id"
        },
        "is_representative": {
          "title": "Is Representative",
          "type": "boolean"
        },
        "threat_class": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Threat Class"
        },
        "severity_label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Severity Label"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "project_id",
        "experiment_id",
        "thread_id",
        "conversation",
        "prompt",
        "response",
        "result",
        "gen_category",
        "fail_category",
        "explanation",
        "severity",
        "confidence",
        "exec_t",
        "feedback",
        "is_representative",
        "threat_class",
        "severity_label"
      ],
      "title": "LogResponse",
      "type": "object"
    },
    "MergedSelectors": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Owner Id"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "access_level": {
          "title": "Access Level",
          "type": "string"
        },
        "accepted": {
          "title": "Accepted",
          "type": "boolean"
        },
        "username": {
          "default": "",
          "title": "Username",
          "type": "string"
        },
        "picture": {
          "default": "",
          "title": "Picture",
          "type": "string"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "email",
        "access_level",
        "accepted"
      ],
      "title": "MergedSelectors",
      "type": "object"
    },
    "Members": {
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Id"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "access_level": {
          "$ref": "#/definitions/AccessLevels"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Owner Id"
        },
        "accepted": {
          "default": false,
          "title": "Accepted",
          "type": "boolean"
        },
        "routing_preferences": {
          "default": {},
          "title": "Routing Preferences",
          "type": "object"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "email",
        "organisation_id",
        "access_level"
      ],
      "title": "Members",
      "type": "object"
    },
    "AccessLevels": {
      "enum": [
        "owner",
        "admin",
        "developer",
        "expert"
      ],
      "title": "AccessLevels",
      "type": "string"
    },
    "Invitation": {
      "properties": {
        "id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Id"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "access_level": {
          "$ref": "#/definitions/AccessLevels"
        },
        "email": {
          "format": "email",
          "title": "Email",
          "type": "string"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "access_level",
        "email"
      ],
      "title": "Invitation",
      "type": "object"
    },
    "MemberResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Owner Id"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "access_level": {
          "title": "Access Level",
          "type": "string"
        },
        "accepted": {
          "title": "Accepted",
          "type": "boolean"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "routing_preferences": {
          "default": {},
          "title": "Routing Preferences",
          "type": "object"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "organisation_id",
        "access_level",
        "accepted",
        "email"
      ],
      "title": "MemberResponse",
      "type": "object"
    },
    "MemberUpdate": {
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Owner Id"
        },
        "accepted": {
          "default": null,
          "title": "Accepted",
          "type": "boolean"
        },
        "routing_preferences": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Routing Preferences"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "MemberUpdate",
      "type": "object"
    },
    "SubscriptionResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "plan_freq": {
          "title": "Plan Freq",
          "type": "string"
        },
        "plan_freq_in_days": {
          "title": "Plan Freq In Days",
          "type": "integer"
        },
        "plan_level": {
          "title": "Plan Level",
          "type": "string"
        },
        "agreement": {
          "title": "Agreement",
          "type": "object"
        },
        "quota": {
          "title": "Quota",
          "type": "object"
        },
        "due_quota": {
          "title": "Due Quota",
          "type": "object"
        },
        "features": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Features"
        },
        "plan_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Plan Id"
        },
        "status": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Status"
        },
        "provider_customer_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Provider Customer Id"
        },
        "provider_subscription_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Provider Subscription Id"
        },
        "current_period_start": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Current Period Start"
        },
        "current_period_end": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Current Period End"
        },
        "cancel_at_period_end": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "title": "Cancel At Period End"
        },
        "scheduled_plan_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Scheduled Plan Level"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "owner_id",
        "name",
        "plan_freq",
        "plan_freq_in_days",
        "plan_level",
        "agreement",
        "quota",
        "due_quota",
        "features",
        "plan_id",
        "status",
        "provider_customer_id",
        "provider_subscription_id",
        "current_period_start",
        "current_period_end",
        "cancel_at_period_end",
        "scheduled_plan_level"
      ],
      "title": "SubscriptionResponse",
      "type": "object"
    },
    "ApiKeyResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "key_prefix": {
          "title": "Key Prefix",
          "type": "string"
        },
        "owner_id": {
          "title": "Owner Id",
          "type": "string"
        },
        "is_active": {
          "title": "Is Active",
          "type": "boolean"
        },
        "expires_at": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Expires At"
        },
        "scope": {
          "$ref": "#/definitions/ApiKeyScope"
        },
        "organisations": {
          "items": {
            "type": "string"
          },
          "title": "Organisations",
          "type": "array"
        },
        "projects": {
          "items": {
            "type": "string"
          },
          "title": "Projects",
          "type": "array"
        },
        "last_used_at": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Last Used At"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "name",
        "key_prefix",
        "owner_id",
        "is_active",
        "expires_at",
        "scope",
        "organisations",
        "projects",
        "last_used_at"
      ],
      "title": "ApiKeyResponse",
      "type": "object"
    },
    "ApiKeyScope": {
      "enum": [
        "read",
        "write",
        "admin"
      ],
      "title": "ApiKeyScope",
      "type": "string"
    },
    "ApiKeyCreateRequest": {
      "description": "Client-settable fields on key creation. owner_id/key_hash/key_prefix/is_active are\nserver-controlled and dropped if present in the body (mass-assignment guard).",
      "properties": {
        "name": {
          "maxLength": 50,
          "title": "Name",
          "type": "string"
        },
        "scope": {
          "$ref": "#/definitions/ApiKeyScope",
          "default": "read"
        },
        "organisations": {
          "default": [
            "*"
          ],
          "items": {
            "type": "string"
          },
          "minItems": 1,
          "title": "Organisations",
          "type": "array"
        },
        "projects": {
          "default": [
            "*"
          ],
          "items": {
            "type": "string"
          },
          "minItems": 1,
          "title": "Projects",
          "type": "array"
        },
        "expires_at": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Expires At"
        }
      },
      "required": [
        "name"
      ],
      "title": "ApiKeyCreateRequest",
      "type": "object"
    },
    "PaginationResponse_ApiKeysResponse": {
      "properties": {
        "has_next_page": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": false,
          "title": "Has Next Page"
        },
        "total": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Total"
        },
        "size": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 15,
          "title": "Size"
        },
        "page": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": 0,
          "title": "Page"
        },
        "data": {
          "default": [],
          "items": {
            "$ref": "#/definitions/ApiKeyResponse"
          },
          "title": "Data",
          "type": "array"
        }
      },
      "title": "PaginationResponse_ApiKeysResponse",
      "type": "object"
    },
    "ApiKeyUpdate": {
      "properties": {
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Updated At"
        },
        "name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Name"
        },
        "scope": {
          "anyOf": [
            {
              "$ref": "#/definitions/ApiKeyScope"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "organisations": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "minItems": 1,
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Organisations"
        },
        "projects": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "minItems": 1,
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Projects"
        },
        "is_active": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Is Active"
        },
        "expires_at": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Expires At"
        }
      },
      "required": [
        "updated_at"
      ],
      "title": "ApiKeyUpdate",
      "type": "object"
    },
    "OrgPostureResponse": {
      "description": "Response for GET /organisations/{id}/posture (swagger).",
      "properties": {
        "posture": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Posture"
        },
        "grade": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Grade"
        },
        "dimensions": {
          "anyOf": [
            {
              "$ref": "#/definitions/OrgPostureDimensions"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "projects": {
          "default": 0,
          "title": "Projects",
          "type": "integer"
        },
        "risk_level": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Risk Level"
        },
        "worst_project": {
          "anyOf": [
            {
              "$ref": "#/definitions/OrgPostureWorstProject"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "findings": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Findings"
        }
      },
      "title": "OrgPostureResponse",
      "type": "object"
    },
    "OrgPostureDimensions": {
      "description": "Dimensional breakdown of org posture.",
      "properties": {
        "security": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Security"
        },
        "quality": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Quality"
        }
      },
      "title": "OrgPostureDimensions",
      "type": "object"
    },
    "OrgPostureWorstProject": {
      "description": "Worst-performing project in org posture.",
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "score": {
          "title": "Score",
          "type": "number"
        },
        "grade": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Grade"
        }
      },
      "required": [
        "id",
        "name",
        "score"
      ],
      "title": "OrgPostureWorstProject",
      "type": "object"
    },
    "WebhookResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "name": {
          "title": "Name",
          "type": "string"
        },
        "url": {
          "title": "Url",
          "type": "string"
        },
        "secret": {
          "title": "Secret",
          "type": "string"
        },
        "event_types": {
          "items": {
            "type": "string"
          },
          "title": "Event Types",
          "type": "array"
        },
        "project_ids": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "title": "Project Ids"
        },
        "is_active": {
          "title": "Is Active",
          "type": "boolean"
        },
        "custom_headers": {
          "title": "Custom Headers",
          "type": "object"
        }
      },
      "required": [
        "id",
        "created_at",
        "updated_at",
        "organisation_id",
        "name",
        "url",
        "secret",
        "event_types",
        "project_ids",
        "is_active",
        "custom_headers"
      ],
      "title": "WebhookResponse",
      "type": "object"
    },
    "WebhookDeliveryResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "webhook_id": {
          "title": "Webhook Id",
          "type": "string"
        },
        "event_id": {
          "title": "Event Id",
          "type": "string"
        },
        "attempt": {
          "title": "Attempt",
          "type": "integer"
        },
        "status_code": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "title": "Status Code"
        },
        "response_body": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Response Body"
        },
        "error": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Error"
        },
        "delivered_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "title": "Delivered At"
        }
      },
      "required": [
        "id",
        "created_at",
        "webhook_id",
        "event_id",
        "attempt",
        "status_code",
        "response_body",
        "error",
        "delivered_at"
      ],
      "title": "WebhookDeliveryResponse",
      "type": "object"
    },
    "WebhookEventResponse": {
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "organisation_id": {
          "title": "Organisation Id",
          "type": "string"
        },
        "project_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Project Id"
        },
        "event_type": {
          "title": "Event Type",
          "type": "string"
        },
        "payload": {
          "title": "Payload",
          "type": "object"
        }
      },
      "required": [
        "id",
        "created_at",
        "organisation_id",
        "project_id",
        "event_type",
        "payload"
      ],
      "title": "WebhookEventResponse",
      "type": "object"
    },
    "ThreatClassResponse": {
      "description": "API response schema.",
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "description": {
          "title": "Description",
          "type": "string"
        },
        "severity_weight": {
          "title": "Severity Weight",
          "type": "number"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "discovered_by": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Discovered By"
        },
        "external_mappings": {
          "title": "External Mappings",
          "type": "object"
        },
        "id": {
          "title": "Id",
          "type": "string"
        },
        "created_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Created At"
        },
        "updated_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "title": "Updated At"
        }
      },
      "required": [
        "name",
        "description",
        "severity_weight",
        "status",
        "external_mappings",
        "id",
        "created_at",
        "updated_at"
      ],
      "title": "ThreatClassResponse",
      "type": "object"
    },
    "ProjectAggregatorResponse": {
      "properties": {
        "firewall": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Firewall"
        },
        "policy_recommendations": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Policy Recommendations"
        },
        "review_queue": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "title": "Review Queue"
        }
      },
      "required": [
        "firewall",
        "policy_recommendations",
        "review_queue"
      ],
      "title": "ProjectAggregatorResponse",
      "type": "object"
    },
    "OrganisationAggregatorResponse": {
      "properties": {
        "invitations": {
          "$ref": "#/definitions/OrganisationInvitationAggregatorResponse"
        }
      },
      "required": [
        "invitations"
      ],
      "title": "OrganisationAggregatorResponse",
      "type": "object"
    },
    "OrganisationInvitationAggregatorResponse": {
      "properties": {
        "accepted": {
          "title": "Accepted",
          "type": "object"
        },
        "pending": {
          "title": "Pending",
          "type": "object"
        }
      },
      "required": [
        "accepted",
        "pending"
      ],
      "title": "OrganisationInvitationAggregatorResponse",
      "type": "object"
    },
    "AssessmentCreateResponse": {
      "description": "Response for POST /projects/{id}/assess.",
      "properties": {
        "assessment_id": {
          "title": "Assessment Id",
          "type": "string"
        },
        "status": {
          "title": "Status",
          "type": "string"
        }
      },
      "required": [
        "assessment_id",
        "status"
      ],
      "title": "AssessmentCreateResponse",
      "type": "object"
    },
    "AssessmentListItem": {
      "description": "Single assessment entry in list view.",
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "domain": {
          "items": {
            "type": "string"
          },
          "title": "Domain",
          "type": "array"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "activity": {
          "title": "Activity",
          "type": "string"
        },
        "test_count": {
          "default": 0,
          "title": "Test Count",
          "type": "integer"
        },
        "posture_before": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Posture Before"
        },
        "posture_after": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Posture After"
        },
        "drift_score": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Drift Score"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Completed At"
        },
        "findings_discovered": {
          "default": 0,
          "title": "Findings Discovered",
          "type": "integer"
        },
        "discovery_plan": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Discovery Plan"
        },
        "trigger_source": {
          "title": "Trigger Source",
          "type": "string"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Owner Id"
        }
      },
      "required": [
        "id",
        "domain",
        "status",
        "activity",
        "trigger_source",
        "owner_id"
      ],
      "title": "AssessmentListItem",
      "type": "object"
    },
    "AssessmentHistoryResponse": {
      "description": "Chart-friendly envelope for the assessment history timeline.\n\n`period_start`/`period_end` come from the `?days=N` query window \u2014 useful\nfor self-documenting range labels regardless of whether `data_points` is\nempty.",
      "properties": {
        "data_points": {
          "items": {
            "$ref": "#/definitions/AssessmentHistoryDataPoint"
          },
          "title": "Data Points",
          "type": "array"
        },
        "period_start": {
          "title": "Period Start",
          "type": "string"
        },
        "period_end": {
          "title": "Period End",
          "type": "string"
        }
      },
      "required": [
        "data_points",
        "period_start",
        "period_end"
      ],
      "title": "AssessmentHistoryResponse",
      "type": "object"
    },
    "AssessmentHistoryDataPoint": {
      "description": "One assessment event in chart-friendly flat shape.\n\nFlat keys map directly onto chart libraries (Recharts/Nivo) without\nintermediate transformation \u2014 `dataKey=\"score\"` and `dataKey=\"completed_at\"`\nwork as-is.",
      "properties": {
        "score": {
          "title": "Score",
          "type": "number"
        },
        "grade": {
          "title": "Grade",
          "type": "string"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Completed At"
        },
        "findings_discovered": {
          "default": 0,
          "title": "Findings Discovered",
          "type": "integer"
        },
        "domain": {
          "default": [],
          "items": {
            "type": "string"
          },
          "title": "Domain",
          "type": "array"
        }
      },
      "required": [
        "score",
        "grade"
      ],
      "title": "AssessmentHistoryDataPoint",
      "type": "object"
    },
    "AssessmentDetailResponse": {
      "description": "Response for GET /projects/{id}/assessments/{aid}.",
      "properties": {
        "id": {
          "title": "Id",
          "type": "string"
        },
        "domain": {
          "items": {
            "type": "string"
          },
          "title": "Domain",
          "type": "array"
        },
        "status": {
          "title": "Status",
          "type": "string"
        },
        "activity": {
          "title": "Activity",
          "type": "string"
        },
        "test_count": {
          "default": 0,
          "title": "Test Count",
          "type": "integer"
        },
        "posture_before": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Posture Before"
        },
        "posture_after": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Posture After"
        },
        "drift_score": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Drift Score"
        },
        "started_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Started At"
        },
        "completed_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Completed At"
        },
        "discovery_plan": {
          "anyOf": [
            {
              "type": "object"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Discovery Plan"
        },
        "trigger_source": {
          "title": "Trigger Source",
          "type": "string"
        },
        "owner_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Owner Id"
        },
        "findings_discovered": {
          "default": 0,
          "title": "Findings Discovered",
          "type": "integer"
        }
      },
      "required": [
        "id",
        "domain",
        "status",
        "activity",
        "trigger_source",
        "owner_id"
      ],
      "title": "AssessmentDetailResponse",
      "type": "object"
    },
    "AssessmentFindingItem": {
      "description": "One finding attributed to an assessment by evidence.\n\nDescriptive fields only \u2014 evidence, delegation and retest state belong to\nthe Findings page. `is_new` is computed: first seen within this run.",
      "properties": {
        "project_id": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Project Id"
        },
        "domain": {
          "default": "security",
          "title": "Domain",
          "type": "string"
        },
        "title": {
          "title": "Title",
          "type": "string"
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Description"
        },
        "category": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Category"
        },
        "threat_class": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": "",
          "title": "Threat Class"
        },
        "severity_label": {
          "$ref": "#/definitions/FindingSeverity",
          "default": "medium"
        },
        "severity": {
          "default": 0.5,
          "title": "Severity",
          "type": "number"
        },
        "confidence": {
          "default": 0.0,
          "title": "Confidence",
          "type": "number"
        },
        "status": {
          "$ref": "#/definitions/FindingStatus",
          "default": "open"
        },
        "id": {
          "title": "Id",
          "type": "string"
        },
        "occurrence_count": {
          "default": 0,
          "title": "Occurrence Count",
          "type": "integer"
        },
        "first_seen_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "First Seen At"
        },
        "last_seen_at": {
          "anyOf": [
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Last Seen At"
        },
        "is_new": {
          "default": false,
          "title": "Is New",
          "type": "boolean"
        }
      },
      "required": [
        "title",
        "id"
      ],
      "title": "AssessmentFindingItem",
      "type": "object"
    },
    "IntegrationEventEnvelope": {
      "description": "Envelope for inbound integration events posted by external systems.\n\nThe data field is intentionally untyped at this layer \u2014 handlers\nparse it into the event-specific data model (e.g. FindingAssignedData)\nafter dispatching on event_type.",
      "properties": {
        "event_type": {
          "enum": [
            "finding.assigned",
            "finding.acknowledged",
            "finding.resolution_verified",
            "finding.resolution_failed"
          ],
          "title": "Event Type",
          "type": "string"
        },
        "finding_id": {
          "title": "Finding Id",
          "type": "string"
        },
        "data": {
          "title": "Data",
          "type": "object"
        }
      },
      "required": [
        "event_type",
        "finding_id"
      ],
      "title": "IntegrationEventEnvelope",
      "type": "object"
    }
  },
  "host": "aiandme-api.azurewebsites.net",
  "basePath": "/api",
  "schemes": [
    "https",
    "http"
  ],
  "securityDefinitions": {
    "Bearer": {
      "type": "apiKey",
      "name": "Authorization",
      "in": "header",
      "description": "Enter your Bearer token in the format: `Bearer <token>`"
    }
  }
}