osctrl-api.yaml

openapi: 3.0.0
info:
  contact:
    name: osctrl
    url: https://github.com/jmpsec/osctrl
  description: API service for osctrl, a fast and efficient osquery management solution.
  license:
    name: MIT
    url: https://github.com/jmpsec/osctrl/blob/master/LICENSE
  termsOfService: https://github.com/jmpsec/osctrl
  title: osctrl API
  version: 0.6.2
paths:
  /:
    get:
      description: Returns the API root liveness response.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API root liveness check
      tags:
        - system
  /api/v1/alerts/apply:
    post:
      description: Queues a reload-alerts service command for osctrl-tls. The TLS
        process reloads its alert rule snapshot and resets the channel sender
        cache without restarting. The snapshot swap is atomic; in-flight matches
        finish against the old ruleset.
      responses:
        "202":
          description: Reload requested
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigApplyResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled or service commands unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply alert changes (hot reload)
      tags:
        - alerts
  /api/v1/alerts/channels:
    get:
      description: Returns alert channel rows. Secrets are redacted unless reveal=1 is
        passed by a superuser.
      parameters:
        - description: Environment ID; omit to list all
          in: query
          name: env
          schema:
            type: integer
        - description: Pass 1 to include secret fields (superuser only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.alertChannelDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List alert channels
      tags:
        - alerts
    post:
      description: Creates a new notification channel. Config is validated against the
        channel type registry.
      requestBody:
        $ref: "#/components/requestBodies/types.AlertChannelCreateRequest"
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create an alert channel
      tags:
        - alerts
  "/api/v1/alerts/channels/{id}":
    delete:
      description: Deletes an alert channel by ID. Rules referencing it keep the
        dangling ID and the dispatcher skips it; deletion takes effect on the
        next alert reload.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an alert channel
      tags:
        - alerts
    get:
      description: Returns a single alert channel by ID. Secrets are redacted unless
        reveal=1 is passed by a superuser.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Pass 1 to include secret fields (superuser only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one alert channel
      tags:
        - alerts
    put:
      description: Replaces an existing channel's mutable fields. A secret field set
        to "***" is merged from the previously stored value.
      parameters:
        - description: Channel ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        $ref: "#/components/requestBodies/types.AlertChannelCreateRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertChannelDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update an alert channel
      tags:
        - alerts
  /api/v1/alerts/channels/test:
    post:
      description: Delivers a test notification through the posted channel config.
        Secrets left as "***" are merged from the stored channel named by id.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.AlertChannelTestRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "502":
          description: Delivery failed
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Test an alert channel
      tags:
        - alerts
  /api/v1/alerts/channels/types:
    get:
      description: "Returns the channel type registry: type, description, whether the
        config carries secrets, and which JSON keys hold them (for webhooks, url
        and secret)."
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.AlertChannelTypeSpec"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List supported alert channel types
      tags:
        - alerts
  /api/v1/alerts/history:
    get:
      description: Returns the most recent dispatched alerts, newest first, capped at 500.
      parameters:
        - description: Maximum rows (default 100, max 500)
          in: query
          name: limit
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/alerts.AlertHistory"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Recent alert history
      tags:
        - alerts
  /api/v1/alerts/rules:
    get:
      description: Returns alert rule rows, optionally filtered by environment.
      parameters:
        - description: Environment ID; omit to list all
          in: query
          name: env
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.alertRuleDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List alert rules
      tags:
        - alerts
    post:
      description: Creates a new alert rule for the given environment (or global when
        environment_id is 0).
      requestBody:
        $ref: "#/components/requestBodies/types.AlertRuleCreateRequest"
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create an alert rule
      tags:
        - alerts
  "/api/v1/alerts/rules/{id}":
    delete:
      description: Deletes an alert rule by ID. Deletion takes effect on the next
        alert reload.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an alert rule
      tags:
        - alerts
    get:
      description: Returns a single alert rule by ID.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one alert rule
      tags:
        - alerts
    put:
      description: Replaces an existing alert rule's mutable fields.
      parameters:
        - description: Rule ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        $ref: "#/components/requestBodies/types.AlertRuleCreateRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.alertRuleDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Alerts disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update an alert rule
      tags:
        - alerts
  "/api/v1/all-queries/{env}":
    get:
      description: Returns on-demand queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List queries
      tags:
        - queries
  /api/v1/audit-logs:
    get:
      description: Returns paginated API audit log entries.
      parameters:
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Service filter
          in: query
          name: service
          schema:
            type: string
        - description: Username filter
          in: query
          name: username
          schema:
            type: string
        - description: Environment filter
          in: query
          name: env
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.AuditLogsPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List audit logs
      tags:
        - audit
  /api/v1/auth-providers/fetch-metadata:
    post:
      description: Fetches the SAML IdP metadata document from the given URL and
        returns the XML.
      requestBody:
        content:
          application/json:
            schema:
              type: object
        description: "{ \\"
        required: true
      responses:
        "200":
          description: '{ \"xml\": \"<EntityDescriptor ...>\" }'
          content:
            application/json:
              schema:
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "502":
          description: Fetch failed
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Fetch IdP metadata XML
      tags:
        - auth-providers
  /api/v1/auth/oidc/callback:
    get:
      description: Handles the OIDC authorization callback and creates an API session.
      parameters:
        - description: OIDC authorization code
          in: query
          name: code
          schema:
            type: string
        - description: OIDC state
          in: query
          name: state
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete OIDC login
      tags:
        - auth
  /api/v1/auth/oidc/login:
    get:
      description: Redirects the browser to the configured OIDC identity provider.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Start OIDC login
      tags:
        - auth
  /api/v1/auth/saml/acs:
    post:
      description: Handles the SAML assertion consumer service callback and creates an
        API session.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                SAMLResponse:
                  description: SAML response assertion
                  type: string
                RelayState:
                  description: SAML relay state
                  type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete SAML login
      tags:
        - auth
  /api/v1/auth/saml/login:
    get:
      description: Redirects the browser to the configured SAML identity provider.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "302":
          description: Found
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Start SAML login
      tags:
        - auth
  /api/v1/auth/saml/metadata:
    get:
      description: Returns service provider metadata for SAML identity provider
        registration.
      responses:
        "200":
          description: OK
          content:
            application/xml:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/xml:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Get SAML metadata
      tags:
        - auth
  "/api/v1/carves/{env}":
    get:
      description: Returns paginated file carves for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarvesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List file carves
      tags:
        - carves
    post:
      description: Starts a new file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiDistributedQueryRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiQueriesResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Run file carve
      tags:
        - carves
  "/api/v1/carves/{env}/{action}/{name}":
    post:
      description: Deletes, expires, or otherwise acts on a file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve action
          in: path
          name: action
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute carve action
      tags:
        - carves
  "/api/v1/carves/{env}/{name}":
    get:
      description: Returns a file carve and the files produced by it.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarveDetailResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get file carve
      tags:
        - carves
  "/api/v1/carves/{env}/archive/{name}":
    get:
      description: Downloads the archive for a completed file carve.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        "400":
          description: Bad request
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Download carve archive
      tags:
        - carves
  "/api/v1/carves/{env}/list":
    get:
      description: Returns paginated file carves for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.CarvesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List file carves
      tags:
        - carves
  "/api/v1/carves/{env}/queries/{target}":
    get:
      description: Returns file carve queries by target and environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Carve target filter
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List carve queries
      tags:
        - carves
  /api/v1/carves/samples:
    get:
      description: Returns sample carve path templates.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/carves.CarveSample"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List carve samples
      tags:
        - carves
  /api/v1/checks-auth:
    get:
      description: Returns API availability for an authenticated user.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Authenticated API check
      tags:
        - checks
  /api/v1/checks-no-auth:
    get:
      description: Returns API availability without requiring authentication.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Unauthenticated API check
      tags:
        - checks
  /api/v1/environments:
    get:
      description: Returns environments visible to the authenticated user.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.TLSEnvironmentView"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List environments
      tags:
        - environments
    post:
      description: Creates an environment.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvCreateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create environment
      tags:
        - environments
  "/api/v1/environments/{env}":
    delete:
      description: Deletes an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete environment
      tags:
        - environments
    get:
      description: Returns one environment by name or UUID.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.TLSEnvironmentView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment
      tags:
        - environments
    patch:
      description: Updates an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment
      tags:
        - environments
  "/api/v1/environments/{env}/enroll/{action}":
    post:
      description: Extends, expires, rotates, or updates enrollment values for an
        environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Enrollment action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiActionsRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute enrollment action
      tags:
        - environments
  "/api/v1/environments/{env}/enroll/{target}":
    get:
      description: Returns enrollment helper values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Enrollment target
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get enrollment values
      tags:
        - environments
  "/api/v1/environments/{env}/packages":
    get:
      description: Returns all enrolling packages for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/environments.EnvironmentPackage"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List enrolling packages
      tags:
        - environments
    post:
      description: Adds a new enrolling package to an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiAddPackageRequest"
        description: Request body
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.EnvironmentPackage"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Add enrolling package
      tags:
        - environments
  "/api/v1/environments/{env}/packages/{id}":
    delete:
      description: Removes an enrolling package from an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Package ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No Content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove enrolling package
      tags:
        - environments
  "/api/v1/environments/{env}/remove/{action}":
    post:
      description: Extends, expires, rotates, or updates removal values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Removal action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiActionsRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute removal action
      tags:
        - environments
  "/api/v1/environments/{env}/remove/{target}":
    get:
      description: Returns removal helper values for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Removal target
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get removal values
      tags:
        - environments
  /api/v1/environments/actions:
    post:
      description: Creates or modifies an environment using the legacy action endpoint.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiEnvRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute environment action
      tags:
        - environments
  "/api/v1/environments/config/{env}":
    get:
      description: Returns raw osquery config sections for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment config
      tags:
        - environments
    patch:
      description: Updates raw osquery config sections for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvConfigPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment config
      tags:
        - environments
  "/api/v1/environments/expiration/{env}":
    patch:
      description: Updates enrollment expiration state for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvExpirationPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment expiration
      tags:
        - environments
  "/api/v1/environments/extensions/{env}":
    get:
      description: Returns the extensions assigned to the environment and the ordinary
        extensions that can be assigned to it. Command-execution extensions are
        only assigned to nodes. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvironmentExtensionsResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment extensions
      tags:
        - environments
  "/api/v1/environments/extensions/{env}/{id}":
    delete:
      description: Removes an extension from the environment. 404 when it is not
        assigned to the environment. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvironmentExtensionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove extension from environment
      tags:
        - environments
    put:
      description: Assigns an ordinary extension to every node of the environment.
        Command-execution extensions are refused with 409. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvironmentExtensionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Command-execution extension
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Assign extension to environment
      tags:
        - environments
  "/api/v1/environments/inactive-hours/{env}":
    delete:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Reset environment inactivity threshold
      tags:
        - environments
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment inactivity threshold
      tags:
        - environments
    put:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.InactiveHoursRequest"
        description: Positive whole hours (1 to 2562047)
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.InactivityPolicy"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set environment inactivity threshold
      tags:
        - environments
  "/api/v1/environments/intervals/{env}":
    patch:
      description: Updates osquery interval settings for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.EnvIntervalsPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.TLSEnvironment"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update environment intervals
      tags:
        - environments
  "/api/v1/environments/map/{target}":
    get:
      description: Returns an environment lookup map by target key.
      parameters:
        - description: "Map target: id, name, or uuid"
          in: path
          name: target
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: "#/components/schemas/environments.NameUUID"
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Map environments
      tags:
        - environments
  "/api/v1/environments/osquery/{env}":
    delete:
      description: Stops rolling the environment out; hosts keep the version they
        have. Clearing an unset target answers 200 and is not audited.
        Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvOsqueryResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Clear environment osquery target
      tags:
        - environments
    get:
      description: Returns the osquery version the environment is rolled out to and
        the number of its hosts per installed version, plus the names (no
        digests) of the library versions it can be set to, and the latest staged
        rollout (null when none). The installed versions, and the host names and
        reasons in the rollout's paused and rolled_back_hosts fields, are
        reported by the hosts and are untrusted. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvOsqueryResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment osquery target
      tags:
        - environments
    put:
      description: "Rolls the environment out to a version of the library in stages of
        1%, 10%, 50% and 100% of its hosts, two hours apart; the first stage
        opens now. Any active rollout is replaced. Hosts at or above the version
        are left alone; osctrld upgrades the others when osqueryd is running.
        Setting the same version again starts a new rollout and retries hosts
        that rejected it. The rollout pauses on a rollback and needs Resume.
        Unknown body fields are refused, and so is expires_at: environment
        targets do not expire (use a node pin for a temporary override).
        Environment admins."
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.OsqueryTargetRequest"
        description: Target version
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvOsqueryResponse"
        "400":
          description: Bad request or version not in the library
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: Request body too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set environment osquery target
      tags:
        - environments
  "/api/v1/environments/osquery/{env}/rollout/abort":
    post:
      description: Aborts a running or paused rollout and clears the environment
        target; hosts keep the version they have and node pins are kept. Answers
        409 when there is no active rollout. The host names and reasons in the
        response are reported by hosts and are untrusted. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvOsqueryResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: No running or paused rollout
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Abort environment osquery rollout
      tags:
        - environments
  "/api/v1/environments/osquery/{env}/rollout/resume":
    post:
      description: Resumes a paused rollout at the stage it paused in and restarts
        that stage's wait. Answers 409 unless the rollout is paused. The host
        names and reasons in the response are reported by hosts and are
        untrusted. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvOsqueryResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Rollout is not paused
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Resume environment osquery rollout
      tags:
        - environments
  "/api/v1/environments/packages/{env}/{id}":
    patch:
      description: Updates the URL of an existing enrolling package.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Package ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiUpdatePackageRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.EnvironmentPackage"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update enrolling package URL
      tags:
        - environments
  "/api/v1/environments/sensitive-paths/{env}":
    get:
      description: Returns the path prefixes only full carve tier may carve or read in
        the environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/environments.SensitivePath"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List sensitive carve paths
      tags:
        - environments
    post:
      description: Adds a path prefix and cancels pending carves of it queued by users
        below full carve tier.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiSensitivePathRequest"
        description: Request body
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/environments.SensitivePath"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Add sensitive carve path
      tags:
        - environments
  "/api/v1/environments/sensitive-paths/{env}/{id}":
    delete:
      description: Removes a sensitive path prefix from the environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Sensitive path ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove sensitive carve path
      tags:
        - environments
  /api/v1/events:
    get:
      description: Best-effort SSE invalidation hints. No replay; refetch REST
        snapshots after stream.ready and retain polling. Requires the
        corresponding environment query/carve/admin permissions. Session-scoped
        console and file_explorer topics require console_session or
        file_explorer_session respectively. Alerts may use env=all. Alerts
        requires the alert admin or read-only admin role. service_commands and
        fleet require the read-only admin role (or higher) and env=all.
      parameters:
        - description: Environment name or UUID; use all only with topic=alerts,
            topic=service_commands, or topic=fleet
          in: query
          name: env
          required: true
          schema:
            type: string
        - description: "Topics: queries, carves, console, file_explorer, alerts,
            service_commands, fleet"
          in: query
          name: topic
          required: true
          explode: true
          schema:
            type: array
            items:
              type: string
        - description: Console session id required when subscribing to topic=console
          in: query
          name: console_session
          schema:
            type: integer
        - description: File explorer session id required when subscribing to
            topic=file_explorer
          in: query
          name: file_explorer_session
          schema:
            type: integer
      responses:
        "200":
          description: "SSE stream: stream.ready, resource.changed, auth.expired"
          content:
            text/event-stream json:
              schema:
                type: string
        "400":
          description: Bad Request
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too Many Requests
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            text/event-stream json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Subscribe to resource change notifications
      tags:
        - Events
  /api/v1/extensions:
    get:
      description: Returns the extensions library with each extension's files and
        assignment counts. Super admins only.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.ExtensionView"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List osquery extensions
      tags:
        - extensions
    post:
      description: Adds an extension to the library. Command-execution extensions can
        only be assigned to individual nodes. Super admins only.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ExtensionCreateRequest"
        description: Extension
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ExtensionView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Name already exists
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create an osquery extension
      tags:
        - extensions
  "/api/v1/extensions/{id}":
    delete:
      description: Removes an extension and its files. Refused while it is assigned to
        any environment or node, or, for a command-execution extension, while a
        host reports it kept (osctrld could not remove it). Super admins only.
      parameters:
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Extension is assigned, or still on a host that could not remove it
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an osquery extension
      tags:
        - extensions
    patch:
      description: Changes the fields that are set. Command execution can only change
        while the extension is not assigned, and cannot be switched off while a
        host reports it kept (osctrld could not remove it). Super admins only.
      parameters:
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ExtensionUpdateRequest"
        description: Fields to change
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ExtensionView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Extension is assigned, or still on a host that could not remove it
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update an osquery extension
      tags:
        - extensions
  "/api/v1/extensions/{id}/files/{platform}/{arch}":
    delete:
      description: Removes the binary for one platform and arch. Super admins only.
      parameters:
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Platform
          in: path
          name: platform
          required: true
          schema:
            type: string
        - description: Architecture
          in: path
          name: arch
          required: true
          schema:
            type: string
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete an osquery extension file
      tags:
        - extensions
    put:
      description: "Stores or replaces the binary for one platform and arch from the
        multipart field `file` (at most 64 MiB). Platforms: darwin (amd64,
        arm64, universal), linux (amd64, arm64), windows (amd64). Super admins
        only."
      parameters:
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Platform
          in: path
          name: platform
          required: true
          schema:
            type: string
        - description: Architecture
          in: path
          name: arch
          required: true
          schema:
            type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  description: Extension binary
                  type: string
                  format: binary
              required:
                - file
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ExtensionFileView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: File too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Upload an osquery extension file
      tags:
        - extensions
  /api/v1/features:
    get:
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.FeaturesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get enabled API features
      tags:
        - Features
  /api/v1/health/status:
    get:
      description: Component health, per-service runtime detail, live-update transport
        counters, and upgrade status. Admin only.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.healthStatusResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Health reporting disabled
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Deployment health
      tags:
        - health
  /api/v1/log-sinks:
    get:
      description: Returns log sink rows, optionally filtered by environment. Secrets
        are redacted unless reveal=1 is passed by an admin.
      parameters:
        - description: Environment ID; omit to list all environments
          in: query
          name: env
          schema:
            type: integer
        - description: Pass 1 to include secret fields in the config (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.logSinkDTO"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List log sinks
      tags:
        - log-sinks
    post:
      description: Creates a new log sink instance for the given environment (or
        global when environment_id is 0).
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkCreateRequest"
        description: Request body
        required: true
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create a log sink
      tags:
        - log-sinks
  "/api/v1/log-sinks/{id}":
    delete:
      description: Deletes a log sink by ID. Deletion takes effect on the next apply/reload.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete a log sink
      tags:
        - log-sinks
    get:
      description: Returns a single log sink by ID. Secrets are redacted unless
        reveal=1 is passed by an admin.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
        - description: Pass 1 to include secret fields (admin only)
          in: query
          name: reveal
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one log sink
      tags:
        - log-sinks
    put:
      description: Replaces an existing log sink's mutable fields. A secret field set
        to "***" is merged from the previously stored value.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update a log sink
      tags:
        - log-sinks
  "/api/v1/log-sinks/{id}/revert":
    post:
      description: Flips a sink's source back to "service" so the next reload re-syncs
        the config from the service configuration. No config change happens here
        — the sync runs in osctrl-tls during the reload.
      parameters:
        - description: Sink ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.logSinkDTO"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Revert sink to service config
      tags:
        - log-sinks
  /api/v1/log-sinks/apply:
    post:
      description: Queues a reload-log-sinks service command for osctrl-tls. The TLS
        process rebuilds its per-environment exporter map from the log_sinks
        table and atomically swaps it in, closing the old sinks. In-flight logs
        to the old sinks may be dropped during the swap; no restart is required.
      responses:
        "202":
          description: Reload requested
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigApplyResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service commands unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply log sink changes (hot reload)
      tags:
        - log-sinks
  /api/v1/log-sinks/clone:
    post:
      description: Copies all log sinks from a source environment (use 0 for global)
        to a target environment. With overwrite=false returns 409 if the target
        already has sinks.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.LogSinkCloneRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.logSinkDTO"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Target has sinks
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Clone sinks from one environment to another
      tags:
        - log-sinks
  /api/v1/log-sinks/types:
    get:
      description: "Returns the sink type registry: type, description, whether the
        config carries secrets, and which JSON keys hold them."
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.LogSinkTypeSpec"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List supported log sink types
      tags:
        - log-sinks
  /api/v1/login:
    post:
      description: Authenticates an API user and returns a JWT token.
      requestBody:
        $ref: "#/components/requestBodies/types.ApiLoginRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log in
      tags:
        - auth
  "/api/v1/login/{env}":
    post:
      description: Authenticates an API user and returns a JWT token.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          schema:
            type: string
          required: true
      requestBody:
        $ref: "#/components/requestBodies/types.ApiLoginRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log in
      tags:
        - auth
  /api/v1/login/environments:
    get:
      description: Returns pre-auth environment choices for the login UI.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.LoginEnvironment"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: List login environments
      tags:
        - auth
  /api/v1/login/mfa:
    post:
      description: Answers an MFA challenge with a TOTP or recovery code and returns a
        JWT token.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.MFALoginRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Complete a login with a second factor
      tags:
        - auth
  /api/v1/login/mfa/enroll/begin:
    post:
      description: Returns a TOTP secret for a user who must enroll before logging in.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAEnrollRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFAEnrollBeginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin enrollment during login
      tags:
        - auth
  /api/v1/login/mfa/enroll/finish:
    post:
      description: Confirms a TOTP enrollment and returns a JWT token plus recovery codes.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAEnrollRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish enrollment during login
      tags:
        - auth
  /api/v1/login/mfa/webauthn/begin:
    post:
      description: Returns WebAuthn assertion options for an MFA challenge.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin a WebAuthn login ceremony
      tags:
        - auth
  /api/v1/login/mfa/webauthn/finish:
    post:
      description: Validates a WebAuthn assertion and returns a JWT token.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiLoginResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish a WebAuthn login ceremony
      tags:
        - auth
  /api/v1/logout:
    post:
      description: Clears API session cookies and revokes the active token when present.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.LogoutResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Log out
      tags:
        - auth
  "/api/v1/logs/{type}/{env}/{uuid}":
    get:
      description: Returns recent status or result logs for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: "Log type: status or result"
          in: path
          name: type
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Maximum number of log rows
          in: query
          name: limit
          schema:
            type: integer
        - description: RFC3339 lower bound
          in: query
          name: since
          schema:
            type: string
        - description: Free-text search (substring, case-insensitive)
          in: query
          name: q
          schema:
            type: string
        - description: Severity filter for status logs (0=info, 1=warning, 2=error)
          in: query
          name: severity
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.NodeLogsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node logs
      tags:
        - logs
  /api/v1/mfa:
    get:
      description: Returns the second factors enrolled on the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFAStatusResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Multi-factor status
      tags:
        - mfa
  /api/v1/mfa/recovery:
    post:
      description: Invalidates the existing recovery codes and returns a new set.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFARecoveryCodesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Regenerate recovery codes
      tags:
        - mfa
  /api/v1/mfa/totp:
    delete:
      description: Disables the authenticator-app factor after confirming the account
        password.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Remove TOTP
      tags:
        - mfa
    post:
      description: Generates a TOTP secret and provisioning URI for the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFATOTPBeginResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin TOTP enrollment
      tags:
        - mfa
  /api/v1/mfa/totp/verify:
    post:
      description: Verifies a code from the authenticator app and returns recovery codes.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.MFACodeRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.MFARecoveryCodesResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Confirm TOTP enrollment
      tags:
        - mfa
  /api/v1/mfa/webauthn:
    post:
      description: Returns WebAuthn creation options for the calling account.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Begin WebAuthn registration
      tags:
        - mfa
  "/api/v1/mfa/webauthn/{id}":
    delete:
      description: Deletes one registered passkey or security key after confirming the
        account password.
      parameters:
        - description: Credential ID
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAPasswordRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Remove a WebAuthn credential
      tags:
        - mfa
  /api/v1/mfa/webauthn/verify:
    post:
      description: Validates a WebAuthn attestation and stores the credential.
      requestBody:
        $ref: "#/components/requestBodies/handlers.MFAWebAuthnRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: Finish WebAuthn registration
      tags:
        - mfa
  "/api/v1/nodes/{env}":
    get:
      description: Returns paginated, filtered, and sorted nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Node status filter
          in: query
          name: status
          schema:
            type: string
        - description: Platform filter
          in: query
          name: platform
          schema:
            type: string
        - description: Sort field
          in: query
          name: sort
          schema:
            type: string
        - description: Sort order
          in: query
          name: order
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List paginated nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/active":
    get:
      description: Returns active enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List active nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/all":
    get:
      description: Returns all enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List all nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/delete":
    post:
      description: Deletes a node from an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiNodeGenericRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete node
      tags:
        - nodes
  "/api/v1/nodes/{env}/inactive":
    get:
      description: Returns inactive enrolled nodes for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.OsqueryNode"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List inactive nodes
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{node}":
    get:
      description: Returns a single enrolled node in an environment, visible to the
        caller (per query/carve tier and scope tags); node_key is included only
        for environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID, hostname, or local name
          in: path
          name: node
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/config":
    delete:
      description: Removes the node's osquery configuration override so it is served
        the environment configuration.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove node configuration override
      tags:
        - nodes
    get:
      description: Returns the node's osquery configuration override, the environment
        configuration and the configuration the node is served.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node configuration override
      tags:
        - nodes
    put:
      description: Sets the node's osquery configuration override, deep-merged over
        the environment configuration. Options that control the connection to
        osctrl and null values are refused.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.NodeConfigRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeConfigResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: Request body too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set node configuration override
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/extensions":
    get:
      description: Returns the extensions the node should run, its command-execution
        assignments and the last status its osctrld reported. Status fields
        other than reported_at and lingering come from the host and are
        untrusted. lingering marks a command-execution extension the node has no
        unexpired assignment for that osctrld reports as kept, i.e. could not
        remove. library, the command-execution extensions that can be assigned,
        is null unless the caller is a super admin.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeExtensionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node extensions
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/extensions/{id}":
    delete:
      description: Removes the extension's assignment to the node. 404 when the node
        has no assignment of that extension. Super admins only.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeExtensionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove command-execution extension from node
      tags:
        - nodes
    put:
      description: 'Allows command execution on the node through the extension until
        expires_at. The body must be exactly {"expires_at": ...}: a future RFC
        3339 time, or an explicit null for no expiry. A missing expires_at, any
        other key or trailing data is refused with 400. Ordinary extensions are
        refused with 409. Super admins only.'
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Extension ID
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.NodeExtensionAssignRequest"
        description: Expiry
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeExtensionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Not a command-execution extension
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Assign command-execution extension to node
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/flags":
    delete:
      description: Removes the node's osquery flags override so its osctrld is served
        the environment flags. The osctrld apply_result, apply_error, apply_at,
        osquery_running, down_since, flags_stage and extensions_stage fields are
        reported by the host and are untrusted; reported_at is the server's
        receive time and report_stale is set when it is older than 15 minutes.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeFlagsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove node flags override
      tags:
        - nodes
    get:
      description: Returns the node's osquery flags override, the environment flags,
        the flags the node's osctrld is served, flags that are also set as
        configuration options, and the last osctrld fetch. The osctrld
        apply_result, apply_error, apply_at, osquery_running, down_since,
        flags_stage and extensions_stage fields are reported by the host and are
        untrusted; reported_at is the server's receive time and report_stale is
        set when it is older than 15 minutes.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeFlagsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node flags override
      tags:
        - nodes
    put:
      description: Sets the node's osquery flags override, one flag per line, merged
        over the environment flags osctrld fetches. Flags that control the
        connection to osctrl and repeated flags are refused. The osctrld
        apply_result, apply_error, apply_at, osquery_running, down_since,
        flags_stage and extensions_stage fields are reported by the host and are
        untrusted; reported_at is the server's receive time and report_stale is
        set when it is older than 15 minutes.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.NodeFlagsRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeFlagsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: Request body too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set node flags override
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/osquery":
    delete:
      description: Removes the node's pin so it follows the environment target.
        Removing an absent pin answers 200 and is not audited. The installed
        version and the upgrade result, version, reason and request_id are
        reported by the host and are untrusted. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeOsqueryResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove node osquery pin
      tags:
        - nodes
    get:
      description: Returns the node's pin, the version it is rolled out to (the
        unexpired pin, else the environment target), the osquery version it
        reports as installed, whether its platform is unsupported by osctrld
        upgrades (no package, e.g. freebsd), its stage in the environment
        rollout (rollout, null unless the environment target is a running or
        paused rollout; eligible_at is when that stage opens and is null when
        paused or already open), the names (no digests) of the library versions
        it can be pinned to and the last upgrade report of its osctrld. The
        installed version and the upgrade result, version, reason and request_id
        are reported by the host and are untrusted; reported_at is the server's
        receive time. Environment admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeOsqueryResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node osquery upgrade state
      tags:
        - nodes
    put:
      description: Pins the node to a version of the library, overriding the
        environment target, optionally until expires_at (RFC 3339, in the
        future). Changing only the expiry of the pinned version (in the same
        environment) keeps its request_id, so a version the host rejected is not
        retried; setting the same version with the same expiry again (or another
        version) gets a new request_id and retries. Unknown body fields are
        refused. The installed version and the upgrade result, version, reason
        and request_id are reported by the host and are untrusted. Environment
        admins.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.OsqueryTargetRequest"
        description: Pin
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.NodeOsqueryResponse"
        "400":
          description: Bad request, version not in the library or expiry in the past
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: Request body too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Pin node osquery version
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/posture":
    get:
      description: Returns security and compliance posture data for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/posture.NodePosture"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node posture
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/posture/score":
    get:
      description: Returns a security and compliance risk score based on posture data.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/posture.PostureScore"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node posture risk score
      tags:
        - nodes
  "/api/v1/nodes/{env}/node/{uuid}/vulnerabilities":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vulns.NodeReport"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Vulnerability findings for one node
      tags:
        - vulnerabilities
  "/api/v1/nodes/{env}/tag":
    post:
      description: Adds or updates a tag on a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiNodeTagRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Tag node
      tags:
        - nodes
  /api/v1/nodes/lookup:
    post:
      description: Looks up a node by UUID, hostname, or local name.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiLookupRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/nodes.OsqueryNode"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Lookup node
      tags:
        - nodes
  /api/v1/osquery/tables:
    get:
      description: Returns the osquery schema table metadata known to the API.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.OsqueryTable"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List osquery tables
      tags:
        - osquery
  /api/v1/osquery/versions:
    get:
      description: Returns the osquery versions osctrld can roll out, with the SHA-256
        of each official package and whether a target or pin uses the version.
        Super admins only.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.OsqueryVersionView"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List osquery versions
      tags:
        - osquery
  "/api/v1/osquery/versions/{version}":
    delete:
      description: Removes a version and its digests from the library. Refused with
        409 while an environment target or an unexpired node pin uses it. Super
        admins only.
      parameters:
        - description: Osquery version, for example 5.13.0
          in: path
          name: version
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Invalid version
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Version in use
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Remove osquery version
      tags:
        - osquery
    put:
      description: Adds or replaces the package SHA-256 digests of a version (linux
        deb/rpm amd64/arm64, darwin pkg universal, windows msi amd64), each
        combination at most once. Unknown body fields are refused. Changing a
        digest of a version used by a target or pin is refused with 409. Super
        admins only.
      parameters:
        - description: Osquery version, for example 5.13.0
          in: path
          name: version
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.OsqueryVersionPutRequest"
        description: Digests
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.OsqueryVersionView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Version in use
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "413":
          description: Request body too large
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set osquery version digests
      tags:
        - osquery
  "/api/v1/platforms/{env}":
    get:
      description: Returns platform counts for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/nodes.PlatformCounts"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List platforms
      tags:
        - platforms
  /api/v1/posture/profiles:
    get:
      description: Returns predefined posture check profiles for different node types.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/posture.PostureProfile"
                type: array
      security:
        - ApiKeyAuth: []
      summary: List posture profiles
      tags:
        - posture
  "/api/v1/posture/profiles/{id}":
    get:
      description: Returns a single posture check profile by ID.
      parameters:
        - description: Profile ID
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/posture.PostureProfile"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get posture profile
      tags:
        - posture
  "/api/v1/queries/{env}":
    get:
      description: Returns on-demand queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.DistributedQuery"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List queries
      tags:
        - queries
    post:
      description: Starts a new distributed query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/types.ApiDistributedQueryRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiQueriesResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Run query
      tags:
        - queries
  "/api/v1/queries/{env}/{action}/{name}":
    post:
      description: Deletes, expires, or otherwise acts on an on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query action
          in: path
          name: action
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute query action
      tags:
        - queries
  "/api/v1/queries/{env}/{name}":
    get:
      description: Returns a single on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/queries.DistributedQuery"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get query
      tags:
        - queries
  "/api/v1/queries/{env}/list/{target}":
    get:
      description: Returns paginated on-demand queries by target and environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query target filter
          in: path
          name: target
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
        - description: Sort field
          in: query
          name: sort
          schema:
            type: string
        - description: Sort order
          in: query
          name: order
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.QueriesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List paginated queries
      tags:
        - queries
  "/api/v1/queries/{env}/results/{name}":
    get:
      description: Returns paginated results for an on-demand query.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: RFC3339 lower bound
          in: query
          name: since
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.QueryResultsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get query results
      tags:
        - queries
  "/api/v1/queries/{env}/results/csv/{name}":
    get:
      description: Streams query results as CSV.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            text/csv:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            text/csv:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Export query results CSV
      tags:
        - queries
  /api/v1/queries/samples:
    get:
      description: Returns sample query templates.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/queries.QuerySample"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List query samples
      tags:
        - queries
  "/api/v1/santa/{env}/config":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.SantaConfigResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get the Santa sync configuration
      tags:
        - santa
    put:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.SantaConfigRequest"
        description: Config
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.SantaConfigResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update the Santa sync configuration
      tags:
        - santa
  "/api/v1/santa/{env}/events":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page (1-based)
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.SantaEventsResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List Santa execution events
      tags:
        - santa
  "/api/v1/santa/{env}/machines":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/santa.Machine"
                type: array
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List Santa machines
      tags:
        - santa
  "/api/v1/santa/{env}/rules":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/santa.Rule"
                type: array
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List Santa rules
      tags:
        - santa
    post:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        $ref: "#/components/requestBodies/handlers.SantaRuleRequest"
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/santa.Rule"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create a Santa rule
      tags:
        - santa
  "/api/v1/santa/{env}/rules/{id}":
    delete:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Rule id
          in: path
          name: id
          required: true
          schema:
            type: integer
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete a Santa rule
      tags:
        - santa
    put:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Rule id
          in: path
          name: id
          required: true
          schema:
            type: integer
      requestBody:
        $ref: "#/components/requestBodies/handlers.SantaRuleRequest"
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/santa.Rule"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update a Santa rule
      tags:
        - santa
  "/api/v1/santa/{env}/token":
    post:
      description: The plaintext token is returned once; the previous token stops
        working immediately.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.SantaTokenResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Rotate the Santa sync token
      tags:
        - santa
  "/api/v1/saved-queries/{env}":
    get:
      description: Returns paginated saved queries for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Page number
          in: query
          name: page
          schema:
            type: integer
        - description: Page size
          in: query
          name: page_size
          schema:
            type: integer
        - description: Search query
          in: query
          name: q
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueriesPagedResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List saved queries
      tags:
        - saved-queries
    post:
      description: Creates a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SavedQueryCreateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueryView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Create saved query
      tags:
        - saved-queries
  "/api/v1/saved-queries/{env}/{name}":
    delete:
      description: Deletes a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Saved query name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete saved query
      tags:
        - saved-queries
    patch:
      description: Updates a saved query in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Saved query name
          in: path
          name: name
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SavedQueryUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SavedQueryView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update saved query
      tags:
        - saved-queries
  /api/v1/service-config:
    get:
      description: Returns all service configuration sections across all services.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/serviceconfig.ServiceConfig"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List all service config sections
      tags:
        - service-config
  "/api/v1/service-config/{service}":
    get:
      description: Returns all configuration sections for the given service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/serviceconfig.ServiceConfig"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service config sections for a service
      tags:
        - service-config
  "/api/v1/service-config/{service}/{section}":
    get:
      description: Returns a single configuration section by service and section name.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Section name
          in: path
          name: section
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/serviceconfig.ServiceConfig"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get one service config section
      tags:
        - service-config
    put:
      description: Replaces an editable service config section's JSON value.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Section name
          in: path
          name: section
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ServiceConfigUpdateRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/serviceconfig.ServiceConfig"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update service config section
      tags:
        - service-config
  /api/v1/service-config/apply:
    post:
      description: Triggers a graceful service restart to apply DB-edited config changes.
      responses:
        "202":
          description: Restart triggered
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Apply config changes and restart
      tags:
        - service-config
  /api/v1/service-config/persist:
    post:
      description: Persists DB-edited config sections back to the service's YAML file.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ServiceConfigPersistRequest"
        description: Request body
      responses:
        "200":
          description: Written
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigPersistResponse"
        "202":
          description: Write queued
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigPersistResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Config file not writable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Write config changes to disk
      tags:
        - service-config
  "/api/v1/service-config/status/{service}":
    get:
      description: Reports unsaved DB changes and config file writability for a service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ServiceConfigStatusResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Service config file status
      tags:
        - service-config
  /api/v1/settings:
    get:
      description: Returns settings for all services.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List settings
      tags:
        - settings
  "/api/v1/settings/{service}":
    get:
      description: Returns settings for a service.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service settings
      tags:
        - settings
  "/api/v1/settings/{service}/{env}":
    get:
      description: Returns settings for a service and environment.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/settings.SettingValue"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List service environment settings
      tags:
        - settings
  "/api/v1/settings/{service}/{name}":
    patch:
      description: Updates a mutable setting value.
      parameters:
        - description: Service name
          in: path
          name: service
          required: true
          schema:
            type: string
        - description: Setting name
          in: path
          name: name
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SettingPatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/settings.SettingValue"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update setting
      tags:
        - settings
  /api/v1/stats:
    get:
      description: Returns cross-environment dashboard statistics.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.StatsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get dashboard stats
      tags:
        - stats
  "/api/v1/stats/activity/{env}":
    get:
      description: Returns activity buckets for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.ActivityBucket"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment activity
      tags:
        - stats
  "/api/v1/stats/activity/env-tiles/{env}":
    get:
      description: Returns Redis-backed hourly activity series for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/activity.EnvSeries"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment activity tiles
      tags:
        - stats
  "/api/v1/stats/activity/error-nodes/{env}":
    get:
      description: Returns nodes with the most ERROR-severity osquery status logs.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Days of history (default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.ErrorNodeRow"
                type: array
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Top erroring nodes for an environment
      tags:
        - stats
  "/api/v1/stats/activity/node-batch/{env}":
    get:
      description: Returns activity buckets for multiple nodes in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Comma-separated node UUIDs
          in: query
          name: uuids
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  items:
                    $ref: "#/components/schemas/handlers.NodeActivityBucket"
                  type: array
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity batch
      tags:
        - stats
  "/api/v1/stats/activity/node-tiles-batch/{env}":
    get:
      description: Returns Redis-backed hourly activity series for multiple nodes.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Comma-separated node UUIDs
          in: query
          name: uuids
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: "#/components/schemas/activity.NodeTileSeries"
                type: object
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity tiles batch
      tags:
        - stats
  "/api/v1/stats/activity/node-tiles/{env}/{uuid}":
    get:
      description: Returns Redis-backed hourly activity series for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Days of history (1-7, default 1)
          in: query
          name: days
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/activity.NodeTileSeries"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get per-node activity tiles
      tags:
        - stats
  "/api/v1/stats/activity/node/{env}/{uuid}":
    get:
      description: Returns activity buckets for a node.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Node UUID
          in: path
          name: uuid
          required: true
          schema:
            type: string
        - description: Number of hours to include
          in: query
          name: hours
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.NodeActivityBucket"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get node activity
      tags:
        - stats
  /api/v1/stats/osquery-versions:
    get:
      description: Returns fleet-wide osquery version counts.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/nodes.OsqueryVersionCount"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get osquery version stats
      tags:
        - stats
  /api/v1/tags:
    get:
      description: Returns tags across environments.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/tags.AdminTag"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List tags
      tags:
        - tags
  "/api/v1/tags/{env}":
    get:
      description: Returns tags for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/tags.AdminTag"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List environment tags
      tags:
        - tags
  "/api/v1/tags/{env}/{action}":
    post:
      description: Creates, updates, deletes, or applies tags in an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Tag action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiTagsRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute tag action
      tags:
        - tags
  "/api/v1/tags/{env}/{name}":
    get:
      description: Returns one tag by name for an environment.
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Tag name
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/tags.AdminTag"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get environment tag
      tags:
        - tags
  /api/v1/users:
    get:
      description: Returns API users.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/types.AdminUserView"
                type: array
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List users
      tags:
        - users
  "/api/v1/users/{username}":
    get:
      description: Returns an API user by username.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.AdminUserView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get user
      tags:
        - users
  "/api/v1/users/{username}/{action}":
    post:
      description: Creates, updates, deletes, or changes flags on a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
        - description: User action
          in: path
          name: action
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.ApiUserRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiDataResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Execute user action
      tags:
        - users
  "/api/v1/users/{username}/permissions":
    get:
      description: Returns per-environment permissions for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.GetPermissionsResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get user permissions
      tags:
        - users
    post:
      description: Sets per-environment permissions for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SetPermissionsRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.EnvAccessView"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set user permissions
      tags:
        - users
  "/api/v1/users/{username}/permissions/all":
    post:
      description: Sets permissions across all environments for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.SetPermissionsAllRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.SetPermissionsAllResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Set all user permissions
      tags:
        - users
  "/api/v1/users/{username}/token":
    delete:
      description: Deletes an API token for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Delete user token
      tags:
        - users
  "/api/v1/users/{username}/token/refresh":
    post:
      description: Refreshes an API token for a user.
      parameters:
        - description: Username
          in: path
          name: username
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.TokenResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Refresh user token
      tags:
        - users
  /api/v1/users/me:
    get:
      description: Returns the currently authenticated user profile.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.UserMeResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Get current user
      tags:
        - users
    patch:
      description: Updates the current user's profile fields.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.UserMePatchRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.UserMeResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Update current user
      tags:
        - users
  /api/v1/users/me/password:
    post:
      description: Changes the current user's password.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/types.PasswordChangeRequest"
        description: Request body
        required: true
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Change current user password
      tags:
        - users
  "/api/v1/vulnerabilities/{env}/advisories/{id}":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: Advisory id
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vulns.AdvisoryDetail"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not Found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: One advisory and the nodes it affects in an environment
      tags:
        - vulnerabilities
  "/api/v1/vulnerabilities/{env}/findings":
    get:
      description: "Open findings in an environment by default. Filters: severity,
        confidence, kev, state (open|resolved|all), package, advisory, page,
        page_size."
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
        - description: critical|high|medium|low|unknown
          in: query
          name: severity
          schema:
            type: string
        - description: confirmed|possible
          in: query
          name: confidence
          schema:
            type: string
        - description: Only CISA KEV findings
          in: query
          name: kev
          schema:
            type: boolean
        - description: open|resolved|all
          in: query
          name: state
          schema:
            type: string
        - description: Package name
          in: query
          name: package
          schema:
            type: string
        - description: Advisory id
          in: query
          name: advisory
          schema:
            type: string
        - description: Page (1-based)
          in: query
          name: page
          schema:
            type: integer
        - description: Page size (max 500)
          in: query
          name: page_size
          schema:
            type: integer
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.VulnFindingsResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: List vulnerability findings
      tags:
        - vulnerabilities
  "/api/v1/vulnerabilities/{env}/summary":
    get:
      parameters:
        - description: Environment name or UUID
          in: path
          name: env
          required: true
          schema:
            type: string
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vulns.Summary"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Vulnerability summary for an environment
      tags:
        - vulnerabilities
  /api/v1/vulnerabilities/feeds:
    get:
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vulns.FeedStatus"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Advisory feed sync status
      tags:
        - vulnerabilities
  /api/v1/vulnerabilities/feeds/sync:
    post:
      description: Super-admin only. The worker picks the request up on its next tick
        (within a minute); the request never downloads anything itself.
      responses:
        "202":
          description: Accepted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiGenericResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      security:
        - ApiKeyAuth: []
      summary: Request an advisory feed sync
      tags:
        - vulnerabilities
  /api/v1/vulnerabilities/profiles:
    get:
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/posture.PostureProfile"
                type: array
      security:
        - ApiKeyAuth: []
      summary: Inventory schedule profiles for vulnerability monitoring
      tags:
        - vulnerabilities
  /error:
    get:
      description: Returns a generic API error response.
      responses:
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                type: string
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API error response
      tags:
        - system
  /forbidden:
    get:
      description: Returns a generic forbidden response.
      responses:
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                type: string
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API forbidden response
      tags:
        - system
  /health:
    get:
      description: Returns the API health response.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: string
        "204":
          description: Degraded — backend unreachable, serving from cache
          content:
            application/json:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "409":
          description: Conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "429":
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/types.ApiErrorResponse"
      summary: API health check
      tags:
        - system
servers:
  - url: /
components:
  requestBodies:
    handlers.MFAWebAuthnRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAWebAuthnRequest"
      description: Request body
      required: true
    types.ApiActionsRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiActionsRequest"
      description: Request body
      required: true
    types.AlertChannelCreateRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.AlertChannelCreateRequest"
      description: Request body
      required: true
    types.ApiDistributedQueryRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiDistributedQueryRequest"
      description: Request body
      required: true
    types.AlertRuleCreateRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.AlertRuleCreateRequest"
      description: Request body
      required: true
    types.ApiLoginRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/types.ApiLoginRequest"
      description: Request body
      required: true
    handlers.MFAEnrollRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAEnrollRequest"
      description: Request body
      required: true
    handlers.MFAPasswordRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.MFAPasswordRequest"
      description: Request body
      required: true
    handlers.SantaRuleRequest:
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/handlers.SantaRuleRequest"
      description: Rule
      required: true
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: Authorization
      type: apiKey
  schemas:
    activity.EnvSeries:
      properties:
        bucket_seconds:
          type: integer
        config:
          items:
            type: integer
          type: array
        enroll:
          items:
            type: integer
          type: array
        query_read:
          items:
            type: integer
          type: array
        query_write:
          items:
            type: integer
          type: array
        result:
          items:
            type: integer
          type: array
        start:
          type: string
        status:
          items:
            type: integer
          type: array
        status_error:
          items:
            type: integer
          type: array
        total:
          items:
            type: integer
          type: array
      type: object
    activity.NodeTileSeries:
      properties:
        bucket_seconds:
          type: integer
        config:
          items:
            type: integer
          type: array
        enroll:
          items:
            type: integer
          type: array
        query_read:
          items:
            type: integer
          type: array
        query_write:
          items:
            type: integer
          type: array
        result:
          items:
            type: integer
          type: array
        start:
          type: string
        status:
          items:
            type: integer
          type: array
        status_error:
          items:
            type: integer
          type: array
        total:
          items:
            type: integer
          type: array
      type: object
    alerts.AlertHistory:
      properties:
        channel_id:
          type: integer
        channel_name:
          type: string
        created_at:
          type: string
        detail:
          description: Detail is the rendered match context (bounded at match time).
          type: string
        entity:
          description: |-
            Entity is what matched: a hostname, a query name, or "node" for
            inactive/recovered rules. Part of the Redis dedupe key.
          type: string
        environment:
          type: string
        id:
          type: integer
        node_uuid:
          type: string
        rule_id:
          description: |-
            RuleID / ChannelID are denormalized as uint rather than FKs so
            deleting a rule or channel does not cascade-delete history.
          type: integer
        rule_name:
          type: string
      type: object
    carves.CarveSample:
      properties:
        category:
          $ref: "#/components/schemas/carves.CarveSampleCategory"
        label:
          type: string
        notes:
          description: |-
            Notes is a brief operator-facing description of why this file is
            worth grabbing during an investigation. Surfaced as a tooltip in
            the SPA template row.
          type: string
        path:
          type: string
        platform:
          $ref: "#/components/schemas/carves.CarveSamplePlatform"
      type: object
    carves.CarveSampleCategory:
      enum:
        - auth
        - logs
        - registry
        - keychain
        - history
        - config
      type: string
      x-enum-varnames:
        - CarveCategoryAuth
        - CarveCategoryLogs
        - CarveCategoryRegistry
        - CarveCategoryKeychain
        - CarveCategoryHistory
        - CarveCategoryConfig
    carves.CarveSamplePlatform:
      enum:
        - linux
        - darwin
        - windows
      type: string
      x-enum-varnames:
        - CarvePlatformLinux
        - CarvePlatformDarwin
        - CarvePlatformWindows
    environments.EnvironmentPackage:
      properties:
        architecture:
          type: string
        created_at:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        is_default:
          type: boolean
        type:
          type: string
        updated_at:
          type: string
        url:
          type: string
      type: object
    environments.NameUUID:
      properties:
        id:
          type: integer
        name:
          type: string
        uuid:
          type: string
      type: object
    environments.SensitivePath:
      properties:
        created_at:
          type: string
        created_by:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        path:
          type: string
        updated_at:
          type: string
      type: object
    environments.TLSEnvironment:
      properties:
        accept_enrolls:
          type: boolean
        atc:
          type: string
        carver_block_path:
          type: string
        carver_init_path:
          type: string
        carves_tls:
          type: boolean
        certificate:
          type: string
        config_interval:
          type: integer
        config_path:
          type: string
        config_tls:
          type: boolean
        configuration:
          type: string
        created_at:
          type: string
        deb_package:
          type: string
        debug_http:
          type: boolean
        decorators:
          type: string
        enroll_expire:
          type: string
        enroll_path:
          type: string
        enroll_secret_path:
          type: string
        flags:
          type: string
        hostname:
          type: string
        icon:
          type: string
        id:
          type: integer
        log_interval:
          type: integer
        log_path:
          type: string
        logging_tls:
          type: boolean
        msi_package:
          type: string
        name:
          type: string
        options:
          type: string
        packs:
          type: string
        pkg_package:
          type: string
        query_interval:
          type: integer
        query_read_path:
          type: string
        query_tls:
          type: boolean
        query_write_path:
          type: string
        remove_expire:
          type: string
        remove_secret_path:
          type: string
        rpm_package:
          type: string
        schedule:
          type: string
        secret:
          type: string
        type:
          type: string
        updated_at:
          type: string
        user_id:
          type: integer
        uuid:
          type: string
      type: object
    gorm.DeletedAt:
      properties:
        time:
          type: string
        valid:
          description: Valid is true if Time is not NULL
          type: boolean
      type: object
    handlers.ActivityBucket:
      properties:
        bucket_start:
          type: string
        carve:
          type: integer
        config:
          type: integer
        enroll:
          type: integer
        query:
          type: integer
      type: object
    handlers.EnvStats:
      properties:
        active:
          type: integer
        active_carves:
          type: integer
        active_queries:
          type: integer
        inactive:
          type: integer
        inactive_hours:
          description: InactiveHours is the effective threshold for this environment,
            including inheritance.
          type: integer
        name:
          type: string
        platform_counts:
          allOf:
            - $ref: "#/components/schemas/nodes.PlatformCounts"
          description: >-
            PlatformCounts buckets the env's nodes by OS family (linux / darwin
            /

            windows / other). Drives the Nodes-table QuickFilters chip row. Counts

            are total (active + inactive), since the filter chip lists all nodes

            of that platform regardless of staleness — the Active/Inactive toggle

            is independent.
        total:
          type: integer
        uuid:
          type: string
      type: object
    handlers.ErrorNodeRow:
      properties:
        errors:
          type: integer
        hostname:
          type: string
        uuid:
          type: string
      type: object
    handlers.FeaturesResponse:
      properties:
        accelerated:
          type: boolean
        alerts:
          description: |-
            Alerts gates the Alerts section in the SPA. Tied to
            --alerts-enabled — when false the /api/v1/alerts routes are not
            registered and the alert tables are not created.
          type: boolean
        auth_providers:
          type: boolean
        console:
          type: boolean
        event_topics:
          items:
            type: string
          type: array
        events:
          type: boolean
        file_explorer:
          type: boolean
        health:
          description: >-
            Health gates the Health section in the SPA. Tied to --health-enabled
            —

            when false the /api/v1/health routes are not registered.
          type: boolean
        log_sinks:
          description: |-
            LogSinks gates the Log Sinks section in the SPA. Tied to the same
            flag as ServiceConfig — the log_sinks routes are registered
            alongside the service-config routes.
          type: boolean
        osctrld:
          description: >-
            Osctrld is true when osctrl-tls runs with --enable-osctrld. Read
            from

            the service config row osctrl-tls maintains in the shared database.
          type: boolean
        posture:
          type: boolean
        santa:
          description: Santa gates the Santa pages in the SPA. Tied to --santa-enabled.
          type: boolean
        service_config:
          description: >-
            ServiceConfig gates the whole Service Config section in the SPA.
            When

            false the /api/v1/service-config routes are not registered at all.
          type: boolean
        vulnerabilities:
          description: |-
            Vulnerabilities gates the vulnerability pages in the SPA. Tied to
            --vuln-enabled — when false the /api/v1/vulnerabilities routes are
            not registered and the vulnerability tables are not created.
          type: boolean
      type: object
    handlers.InactiveHoursRequest:
      properties:
        inactive_hours:
          maximum: 2562047
          minimum: 1
          type: integer
      required:
        - inactive_hours
      type: object
    handlers.LogoutResponse:
      properties:
        auth_source:
          type: string
        idp_client_id:
          type: string
        idp_id_token_hint:
          type: string
        idp_logout_url:
          type: string
      type: object
    handlers.MFACodeRequest:
      properties:
        code:
          type: string
      type: object
    handlers.MFACredential:
      properties:
        created_at:
          type: string
        id:
          type: string
        last_used_at:
          type: string
        name:
          type: string
      type: object
    handlers.MFAEnrollBeginResponse:
      properties:
        qr:
          description: QR is the provisioning URI as a PNG data URI, ready for an <img>.
          type: string
        secret:
          type: string
        uri:
          type: string
      type: object
    handlers.MFAEnrollRequest:
      properties:
        challenge:
          type: string
        code:
          type: string
      type: object
    handlers.MFALoginRequest:
      properties:
        challenge:
          type: string
        code:
          type: string
        method:
          description: Method is "totp" or "recovery".
          type: string
      type: object
    handlers.MFAPasswordRequest:
      properties:
        password:
          type: string
      type: object
    handlers.MFARecoveryCodesResponse:
      properties:
        recovery_codes:
          items:
            type: string
          type: array
      type: object
    handlers.MFAStatusResponse:
      properties:
        credentials:
          items:
            $ref: "#/components/schemas/handlers.MFACredential"
          type: array
        recovery_codes_left:
          type: integer
        required:
          description: |-
            Required mirrors the deployment-wide switch so the profile page can
            explain why a factor cannot be removed.
          type: boolean
        totp_enabled:
          type: boolean
        webauthn_available:
          type: boolean
      type: object
    handlers.MFATOTPBeginResponse:
      properties:
        qr:
          description: QR is the provisioning URI as a PNG data URI, ready for an <img>.
          type: string
        secret:
          type: string
        uri:
          type: string
      type: object
    handlers.MFAWebAuthnRequest:
      properties:
        challenge:
          type: string
        credential:
          type: object
        name:
          type: string
      type: object
    handlers.NodeActivityBucket:
      properties:
        bucket_start:
          type: string
        carve:
          type: integer
        config:
          type: integer
        query:
          type: integer
        result:
          type: integer
        status:
          type: integer
      type: object
    handlers.NodeLogsResponse:
      properties:
        env:
          type: string
        items:
          items:
            additionalProperties: {}
            type: object
          type: array
        limit:
          type: integer
        since:
          type: string
        type:
          type: string
        uuid:
          type: string
      type: object
    handlers.SantaConfigRequest:
      properties:
        batch_size:
          type: integer
        block_usb_mount:
          description: "Deprecated: use removable_media; only read when it is empty (true
            means BLOCK)."
          type: boolean
        client_mode:
          type: string
        enable_transitive_rules:
          type: boolean
        encrypted_removable_media:
          description: "Override for encrypted volumes: ALLOW | BLOCK | REMOUNT; empty
            uses removable_media"
          type: string
        encrypted_removable_media_flags:
          description: Required with encrypted REMOUNT; same values as removable_media_flags
          items:
            type: string
          type: array
        removable_media:
          description: ALLOW | BLOCK | REMOUNT; empty means ALLOW
          type: string
        removable_media_flags:
          description: "Required with REMOUNT: rdonly, noexec, nosuid, nobrowse, noowners,
            nodev, async, -j"
          items:
            type: string
          type: array
      type: object
    handlers.SantaConfigResponse:
      properties:
        batch_size:
          description: 0 means the Santa default (50)
          type: integer
        block_usb_mount:
          description: "Deprecated: derived from removable_media, sent only for older
            Santa clients"
          type: boolean
        client_mode:
          description: MONITOR | LOCKDOWN
          type: string
        created_at:
          type: string
        enable_transitive_rules:
          type: boolean
        encrypted_removable_media:
          description: "Override for encrypted volumes: ALLOW | BLOCK | REMOUNT; empty
            uses removable_media"
          type: string
        encrypted_removable_media_flags:
          description: Mount options used with encrypted REMOUNT
          items:
            type: string
          type: array
        environment_id:
          type: integer
        id:
          type: integer
        removable_media:
          description: ALLOW | BLOCK | REMOUNT
          type: string
        removable_media_flags:
          description: Mount options used with REMOUNT
          items:
            type: string
          type: array
        token_set:
          type: boolean
        updated_at:
          type: string
      type: object
    handlers.SantaEventsResponse:
      properties:
        events:
          items:
            $ref: "#/components/schemas/santa.Event"
          type: array
        page:
          type: integer
        total:
          type: integer
      type: object
    handlers.SantaRuleRequest:
      properties:
        cel_expr:
          type: string
        custom_msg:
          type: string
        custom_url:
          type: string
        identifier:
          type: string
        policy:
          type: string
        rule_type:
          type: string
        scope:
          type: string
        scope_value:
          type: string
      type: object
    handlers.SantaTokenResponse:
      properties:
        token:
          type: string
      type: object
    handlers.StatsResponse:
      properties:
        active_nodes:
          type: integer
        environments:
          description: Per-env breakdown, in stable alphabetical order by name.
          items:
            $ref: "#/components/schemas/handlers.EnvStats"
          type: array
        inactive_hours:
          description: InactiveHours is the global default only; node counts use each
            environment's effective threshold.
          type: integer
        inactive_nodes:
          type: integer
        platform_counts:
          allOf:
            - $ref: "#/components/schemas/nodes.PlatformCounts"
          description: Cross-env platform breakdown — sum of every accessible env's
            PlatformCounts.
        total_active_carves:
          description: TotalActiveCarves counts active carve-type queries.
          type: integer
        total_active_queries:
          description: TotalActiveQueries counts standard query-type active queries
            (excludes carves).
          type: integer
        total_nodes:
          description: Cross-env totals (the user's allowed envs only).
          type: integer
      type: object
    handlers.VulnFindingsResponse:
      properties:
        findings:
          items:
            $ref: "#/components/schemas/vulns.Finding"
          type: array
        page:
          type: integer
        total:
          type: integer
      type: object
    handlers.alertChannelDTO:
      properties:
        config:
          type: object
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    handlers.alertRuleDTO:
      properties:
        channel_ids:
          items:
            type: integer
          type: array
        cooldown_minutes:
          type: integer
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        id:
          type: integer
        info:
          type: string
        match_field:
          type: string
        match_type:
          type: string
        match_value:
          type: string
        name:
          type: string
        node_uuid:
          type: string
        source:
          type: string
        status_severity:
          type: string
        updated_at:
          type: string
        vuln_min_severity:
          type: string
      type: object
    handlers.healthStatusResponse:
      properties:
        components:
          items:
            $ref: "#/components/schemas/health.Component"
          type: array
        generated_at:
          type: string
        upgrade:
          $ref: "#/components/schemas/health.UpgradeInfo"
      type: object
    handlers.logSinkDTO:
      properties:
        bytes_sent:
          type: integer
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        created_at:
          type: string
        enabled:
          type: boolean
        environment_id:
          type: integer
        exports_count:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        source:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    health.Component:
      properties:
        details:
          additionalProperties: {}
          type: object
        id:
          type: string
        name:
          type: string
        status:
          type: string
        summary:
          type: string
      type: object
    health.UpgradeInfo:
      properties:
        api_version:
          description: |-
            API and TLS expose the per-service versions behind Skew so the page
            can name both sides of a mismatch.
          type: string
        checked:
          type: boolean
        checked_at:
          type: string
        current:
          type: string
        latest:
          type: string
        more_information:
          type: string
        skew:
          type: boolean
        suggested:
          type: string
        tls_version:
          type: string
        up_to_date:
          type: boolean
      type: object
    nodes.OsqueryNode:
      properties:
        bytes_received:
          type: integer
        config_hash:
          type: string
        cpu:
          type: string
        created_at:
          type: string
        daemon_hash:
          type: string
        environment:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        hardware_serial:
          type: string
        hostname:
          type: string
        id:
          type: integer
        ip_address:
          type: string
        last_seen:
          type: string
        localname:
          type: string
        memory:
          type: string
        osquery_user:
          type: string
        osquery_version:
          type: string
        platform:
          type: string
        platform_version:
          type: string
        updated_at:
          type: string
        user_id:
          type: integer
        username:
          type: string
        uuid:
          type: string
      type: object
    nodes.OsqueryVersionCount:
      properties:
        count:
          type: integer
        version:
          type: string
      type: object
    nodes.PlatformCounts:
      properties:
        darwin:
          type: integer
        linux:
          type: integer
        other:
          type: integer
        windows:
          type: integer
      type: object
    posture.ControlResult:
      properties:
        category:
          description: posture category the evidence came from
          type: string
        control_id:
          description: e.g. "A.8.24" or "CC6.6"
          type: string
        description:
          type: string
        detail:
          description: human-readable explanation
          type: string
        framework:
          $ref: "#/components/schemas/posture.Framework"
        max_score:
          description: >-
            MaxScore is the risk points this control would contribute if it

            failed outright (its weight). A passing control still reports this so

            callers can renormalize the total after excluding controls — e.g. the

            SPA's "what if I ignore this check" recompute — without needing the

            evaluation rules themselves.
          type: integer
        score:
          description: 0 = pass, otherwise earned risk points
          type: integer
        severity:
          $ref: "#/components/schemas/posture.Severity"
        status:
          description: '"pass", "warn", "fail"'
          type: string
        title:
          type: string
      type: object
    posture.Framework:
      enum:
        - SOC2
        - ISO27001
      type: string
      x-enum-varnames:
        - FrameworkSOC2
        - FrameworkISO27001
    posture.NodePosture:
      properties:
        category:
          type: string
        created_at:
          type: string
        environment:
          type: string
        first_seen:
          description: FirstSeen is when this category was first observed for this node.
          type: string
        id:
          type: integer
        last_seen:
          type: string
        node_uuid:
          type: string
        query_name:
          description: QueryName is the full osquery scheduled-query name including prefix.
          type: string
        row_count:
          description: RowCount is the number of rows in the result (e.g. 3 packages, 5
            users).
          type: integer
        summary:
          description: |-
            Summary is a compact JSON snapshot of the result data. For small
            results this is the full columns array; for large results it's
            truncated to the first 100 rows to keep the record manageable.
          type: string
        updated_at:
          type: string
      type: object
    posture.PostureProfile:
      properties:
        description:
          type: string
        id:
          type: string
        name:
          type: string
        platform:
          type: string
        queries:
          additionalProperties:
            $ref: "#/components/schemas/posture.ProfileQuery"
          type: object
      type: object
    posture.PostureScore:
      properties:
        controls:
          items:
            $ref: "#/components/schemas/posture.ControlResult"
          type: array
        fail_count:
          type: integer
        node_uuid:
          type: string
        pass_count:
          type: integer
        risk_level:
          description: '"low", "medium", "high", "critical"'
          type: string
        timestamp:
          type: string
        total_score:
          description: 0-100 normalized, lower is better
          type: integer
        warn_count:
          type: integer
      type: object
    posture.ProfileQuery:
      properties:
        interval:
          type: integer
        platform:
          type: string
        query:
          type: string
        query_name:
          type: string
        snapshot:
          type: boolean
      type: object
    posture.Severity:
      enum:
        - critical
        - high
        - medium
        - low
      type: string
      x-enum-comments:
        SeverityCritical: immediate risk, must fix
        SeverityHigh: significant risk
        SeverityLow: minor risk
        SeverityMedium: moderate risk
      x-enum-descriptions:
        - immediate risk, must fix
        - significant risk
        - moderate risk
        - minor risk
      x-enum-varnames:
        - SeverityCritical
        - SeverityHigh
        - SeverityMedium
        - SeverityLow
    queries.DistributedQuery:
      properties:
        active:
          type: boolean
        carve_status:
          type: string
        completed:
          type: boolean
        created_at:
          type: string
        creator:
          type: string
        deleted:
          type: boolean
        environment_id:
          type: integer
        errors:
          type: integer
        executions:
          type: integer
        expected:
          type: integer
        expiration:
          type: string
        expired:
          type: boolean
        extra_data:
          type: string
        hidden:
          type: boolean
        id:
          type: integer
        name:
          type: string
        path:
          type: string
        protected:
          type: boolean
        query:
          type: string
        target:
          type: string
        type:
          type: string
        updated_at:
          type: string
      type: object
    queries.QuerySample:
      properties:
        category:
          $ref: "#/components/schemas/queries.QuerySampleCategory"
        description:
          type: string
        name:
          type: string
        platforms:
          items:
            $ref: "#/components/schemas/queries.QuerySamplePlatform"
          type: array
        sql:
          type: string
      type: object
    queries.QuerySampleCategory:
      enum:
        - recon
        - processes
        - users
        - network
        - persistence
        - file_integrity
        - packages
      type: string
      x-enum-varnames:
        - CategoryRecon
        - CategoryProcesses
        - CategoryUsers
        - CategoryNetwork
        - CategoryPersistence
        - CategoryFileIntegrity
        - CategoryPackages
    queries.QuerySamplePlatform:
      enum:
        - linux
        - darwin
        - windows
      type: string
      x-enum-varnames:
        - PlatformLinux
        - PlatformDarwin
        - PlatformWindows
    santa.Event:
      properties:
        bundle_id:
          type: string
        cd_hash:
          type: string
        created_at:
          type: string
        decision:
          type: string
        environment_id:
          type: integer
        executed_at:
          type: string
        executing_user:
          type: string
        file_name:
          type: string
        file_path:
          type: string
        file_sha256:
          type: string
        id:
          type: integer
        machine_id:
          type: string
        node_id:
          type: integer
        signing_id:
          type: string
        team_id:
          type: string
      type: object
    santa.Machine:
      properties:
        applied_digest:
          description: set at postflight
          type: string
        client_mode:
          type: string
        created_at:
          type: string
        environment_id:
          type: integer
        hostname:
          type: string
        id:
          type: integer
        last_preflight_at:
          type: string
        last_sync_at:
          type: string
        machine_id:
          description: uppercase UUID
          type: string
        node_id:
          type: integer
        os_version:
          type: string
        pending_digest:
          description: set at preflight
          type: string
        pending_sync_type:
          description: NORMAL | CLEAN_RULES
          type: string
        primary_user:
          type: string
        rule_count:
          type: integer
        santa_version:
          type: string
        serial_number:
          type: string
        updated_at:
          type: string
      type: object
    santa.Rule:
      properties:
        cel_expr:
          type: string
        created_at:
          type: string
        created_by:
          type: string
        custom_msg:
          type: string
        custom_url:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        identifier:
          type: string
        policy:
          description: ALLOWLIST|ALLOWLIST_COMPILER|BLOCKLIST|SILENT_BLOCKLIST|CEL
          type: string
        rule_type:
          description: BINARY|CERTIFICATE|TEAMID|SIGNINGID|CDHASH
          type: string
        scope:
          description: env|tag|node
          type: string
        scope_value:
          description: '""| tag name | node UUID (uppercase)'
          type: string
        updated_at:
          type: string
      type: object
    serviceconfig.ServiceConfig:
      properties:
        createdAt:
          type: string
        deletedAt:
          $ref: "#/components/schemas/gorm.DeletedAt"
        editable:
          type: boolean
        environmentID:
          type: integer
        id:
          type: integer
        info:
          type: string
        name:
          type: string
        overrides:
          description: >-
            Overrides is a JSON array of the top-level fields an operator pinned
            in

            this section. Only pinned fields beat flags, environment variables and

            YAML at startup; every other field follows the process.


            Empty is meaningful and depends on Source:
              - source=yaml: nothing is pinned.
              - source=db:   a row written before pins existed (or replaced
                wholesale through the API), so EVERY field is pinned. That is the
                only reading that cannot silently drop an operator's edit, since the
                original YAML is gone once a row is overwritten.
          type: string
        service:
          type: string
        source:
          description: '"yaml" or "db"'
          type: string
        type:
          description: always "json" for now
          type: string
        updatedAt:
          type: string
        value:
          type: string
      type: object
    settings.InactivityPolicy:
      properties:
        inactive_hours:
          maximum: 2562047
          minimum: 1
          type: integer
        override_hours:
          maximum: 2562047
          minimum: 1
          type: integer
          nullable: true
        source:
          enum:
            - environment
            - global
            - default
          type: string
      type: object
    settings.SettingValue:
      properties:
        boolean:
          type: boolean
        createdAt:
          type: string
        deletedAt:
          $ref: "#/components/schemas/gorm.DeletedAt"
        environmentID:
          type: integer
        id:
          type: integer
        info:
          type: string
        integer:
          format: int64
          type: integer
        name:
          type: string
        service:
          type: string
        string:
          type: string
        type:
          type: string
        updatedAt:
          type: string
      type: object
    tags.AdminTag:
      properties:
        auto_tag:
          type: boolean
        cohort:
          type: boolean
        color:
          type: string
        created_at:
          type: string
        created_by:
          type: string
        custom_tag:
          type: string
        description:
          type: string
        environment_id:
          type: integer
        icon:
          type: string
        id:
          type: integer
        name:
          type: string
        sensitive:
          type: boolean
        tag_type:
          type: integer
        updated_at:
          type: string
      type: object
    types.AdminUserView:
      properties:
        admin:
          type: boolean
        alert_admin:
          type: boolean
        auth_source:
          description: |-
            AuthSource is empty for the password-login path (the default)
            and "oidc" for users JIT-provisioned through the federated
            callback. Surfaced so the SPA Users page can show an "OIDC"
            badge alongside the existing admin/service labels.
          type: string
        created_at:
          type: string
        email:
          type: string
        env_manager:
          type: boolean
        environment_id:
          type: integer
        fullname:
          type: string
        id:
          type: integer
        read_only_admin:
          type: boolean
        service:
          type: boolean
        token_expire:
          type: string
        updated_at:
          type: string
        user_admin:
          type: boolean
        username:
          type: string
        uuid:
          type: string
      type: object
    types.AlertChannelCreateRequest:
      properties:
        config:
          type: object
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.AlertChannelTestRequest:
      properties:
        config:
          type: object
        id:
          type: integer
        type:
          type: string
      type: object
    types.AlertChannelTypeSpec:
      properties:
        description:
          type: string
        fields:
          items:
            $ref: "#/components/schemas/types.AlertFieldSpec"
          type: array
        has_secret:
          type: boolean
        secret_fields:
          items:
            type: string
          type: array
        type:
          type: string
      type: object
    types.AlertFieldSpec:
      properties:
        default: {}
        help:
          type: string
        label:
          type: string
        name:
          type: string
        placeholder:
          type: string
        required:
          type: boolean
        type:
          type: string
      type: object
    types.AlertRuleCreateRequest:
      properties:
        channel_ids:
          items:
            type: integer
          type: array
        cooldown_minutes:
          type: integer
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        match_field:
          type: string
        match_type:
          type: string
        match_value:
          type: string
        name:
          type: string
        node_uuid:
          description: |-
            NodeUUID optionally scopes the rule to one node (used by the node
            detail page's "Alert on this node" button). Empty = all nodes.
          type: string
        source:
          type: string
        status_severity:
          type: string
        vuln_min_severity:
          description: |-
            VulnMinSeverity is the threshold of a "vuln_finding" rule: kev,
            critical, high, medium, low or any.
          type: string
      type: object
    types.ApiActionsRequest:
      properties:
        certificate:
          type: string
        url_deb_pkg:
          type: string
        url_mac_pkg:
          type: string
        url_msi_pkg:
          type: string
        url_rpm_pkg:
          type: string
      type: object
    types.ApiAddPackageRequest:
      properties:
        architecture:
          type: string
        is_default:
          type: boolean
        type:
          type: string
        url:
          type: string
      type: object
    types.ApiDataResponse:
      properties:
        data:
          type: string
      type: object
    types.ApiDistributedQueryRequest:
      properties:
        environment_list:
          items:
            type: string
          type: array
        exp_hours:
          type: integer
        hidden:
          type: boolean
        host_list:
          items:
            type: string
          type: array
        path:
          type: string
        platform_list:
          items:
            type: string
          type: array
        query:
          type: string
        tag_list:
          items:
            type: string
          type: array
        uuid_list:
          items:
            type: string
          type: array
      type: object
    types.ApiEnvRequest:
      properties:
        action:
          type: string
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
        uuid:
          type: string
      type: object
    types.ApiErrorResponse:
      properties:
        code:
          type: string
        error:
          type: string
      type: object
    types.ApiGenericResponse:
      properties:
        message:
          type: string
      type: object
    types.ApiLoginRequest:
      properties:
        exp_hours:
          type: integer
        password:
          type: string
        username:
          type: string
      type: object
    types.ApiLoginResponse:
      properties:
        csrf_token:
          type: string
        token:
          type: string
      type: object
    types.ApiLookupRequest:
      properties:
        identifier:
          type: string
      type: object
    types.ApiNodeGenericRequest:
      properties:
        uuid:
          type: string
      type: object
    types.ApiNodeTagRequest:
      properties:
        custom:
          type: string
        tag:
          type: string
        type:
          type: integer
        uuid:
          type: string
      type: object
    types.ApiQueriesResponse:
      properties:
        query_name:
          type: string
      type: object
    types.ApiSensitivePathRequest:
      properties:
        path:
          type: string
      type: object
    types.ApiTagsRequest:
      properties:
        color:
          type: string
        custom:
          type: string
        description:
          type: string
        env:
          type: string
        icon:
          type: string
        name:
          type: string
        sensitive:
          type: boolean
        tagtype:
          type: integer
      type: object
    types.ApiUpdatePackageRequest:
      properties:
        url:
          type: string
      type: object
    types.ApiUserRequest:
      properties:
        admin:
          type: boolean
        admin_access:
          type: boolean
        alert_admin:
          type: boolean
        api:
          type: boolean
        carve_access:
          type: boolean
        email:
          type: string
        env_manager:
          type: boolean
        environments:
          items:
            type: string
          type: array
        fullname:
          type: string
        not_admin:
          type: boolean
        not_service:
          type: boolean
        password:
          type: string
        query_access:
          type: boolean
        read_only_admin:
          type: boolean
        service:
          type: boolean
        user_access:
          type: boolean
        user_admin:
          description: Global roles; nil leaves the stored value unchanged.
          type: boolean
        username:
          type: string
      type: object
    types.AuditLogView:
      properties:
        created_at:
          type: string
        env_uuid:
          type: string
        environment_id:
          type: integer
        id:
          type: integer
        line:
          type: string
        log_type:
          type: integer
        service:
          type: string
        severity:
          type: integer
        source_ip:
          type: string
        username:
          type: string
      type: object
    types.AuditLogsPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.AuditLogView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.BIOSInfo:
      properties:
        address:
          type: string
        date:
          type: string
        revision:
          type: string
        size:
          type: string
        vendor:
          type: string
        version:
          type: string
        volume_size:
          type: string
      type: object
    types.CarveDetailResponse:
      properties:
        files:
          items:
            $ref: "#/components/schemas/types.CarveFileView"
          type: array
        query:
          $ref: "#/components/schemas/types.DistributedQueryView"
      type: object
    types.CarveFileView:
      properties:
        archived:
          type: boolean
        block_size:
          type: integer
        carve_id:
          type: string
        carve_size:
          type: integer
        completed_at:
          type: string
        completed_blocks:
          type: integer
        created_at:
          type: string
        path:
          type: string
        session_id:
          type: string
        status:
          type: string
        total_blocks:
          type: integer
        uuid:
          type: string
      type: object
    types.CarvesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/queries.DistributedQuery"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.DistributedQueryView:
      properties:
        active:
          type: boolean
        carve_status:
          type: string
        completed:
          type: boolean
        created_at:
          type: string
        creator:
          type: string
        deleted:
          type: boolean
        environment_id:
          type: integer
        errors:
          type: integer
        executions:
          type: integer
        expected:
          type: integer
        expiration:
          type: string
        expired:
          type: boolean
        extra_data:
          type: string
        hidden:
          type: boolean
        id:
          type: integer
        name:
          type: string
        path:
          type: string
        protected:
          type: boolean
        query:
          type: string
        target:
          type: string
        targets:
          items:
            $ref: "#/components/schemas/types.QueryTargetView"
          type: array
        type:
          type: string
        updated_at:
          type: string
      type: object
    types.EnvAccessView:
      properties:
        admin:
          type: boolean
        carve:
          type: boolean
        carve_tier:
          type: string
        query:
          type: boolean
        query_tier:
          description: >-
            QueryTier and CarveTier are "none", "tags", "standard" or "full"; on

            input they apply only when the matching bool is true (false means none),

            and empty or "none" means the legacy bool applies. ScopeTags limits the "tags" tier

            and is accepted only for a single environment.
          type: string
        scope_tags:
          items:
            type: integer
          type: array
        user:
          type: boolean
      type: object
    types.EnvConfigPatchRequest:
      properties:
        atc:
          type: string
        decorators:
          type: string
        flags:
          type: string
        options:
          type: string
        packs:
          type: string
        schedule:
          type: string
      type: object
    types.EnvConfigResponse:
      properties:
        atc:
          type: string
        decorators:
          type: string
        flags:
          type: string
        options:
          type: string
        packs:
          type: string
        schedule:
          type: string
      type: object
    types.EnvCreateRequest:
      properties:
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.EnvExpirationPatchRequest:
      properties:
        action:
          type: string
      type: object
    types.EnvIntervalsPatchRequest:
      properties:
        config_interval:
          type: integer
        log_interval:
          type: integer
        query_interval:
          type: integer
      type: object
    types.EnvOsqueryResponse:
      properties:
        available:
          description: Available lists the library version names (no digests), ascending.
          items:
            type: string
          type: array
        counts:
          items:
            $ref: "#/components/schemas/types.OsqueryVersionHostCount"
          type: array
        rollout:
          allOf:
            - $ref: "#/components/schemas/types.EnvOsqueryRollout"
          description: Rollout is the environment's latest rollout, null when it never had
            one.
        target:
          $ref: "#/components/schemas/types.OsqueryTargetView"
        windows_hosts:
          description: >-
            WindowsHosts is the number of Windows hosts in the environment;
            Windows

            upgrades cannot be rolled back automatically.
          type: integer
      type: object
    types.EnvOsqueryRolledBackHost:
      properties:
        at:
          type: string
        host:
          type: string
        reason:
          type: string
      type: object
    types.EnvOsqueryRollout:
      properties:
        counts:
          $ref: "#/components/schemas/types.EnvOsqueryRolloutCounts"
        next_stage_at:
          type: string
        paused:
          $ref: "#/components/schemas/types.EnvOsqueryRolledBackHost"
        request_id:
          type: string
        rolled_back_hosts:
          description: RolledBackHosts is newest first, at most 50.
          items:
            $ref: "#/components/schemas/types.EnvOsqueryRolledBackHost"
          type: array
        stage:
          type: integer
        stage_opened_at:
          type: string
        stages:
          items:
            type: integer
          type: array
        state:
          type: string
        version:
          type: string
      type: object
    types.EnvOsqueryRolloutCounts:
      properties:
        eligible:
          type: integer
        rolled_back:
          type: integer
        upgraded:
          type: integer
        waiting:
          type: integer
      type: object
    types.EnvUpdateRequest:
      properties:
        accept_enrolls:
          type: boolean
        debug_http:
          type: boolean
        hostname:
          type: string
        icon:
          type: string
        name:
          type: string
        type:
          type: string
      type: object
    types.EnvironmentExtensionsResponse:
      properties:
        assigned:
          items:
            $ref: "#/components/schemas/types.ExtensionSummary"
          type: array
        available:
          items:
            $ref: "#/components/schemas/types.ExtensionSummary"
          type: array
      type: object
    types.ExtensionCreateRequest:
      properties:
        command_execution:
          type: boolean
        description:
          type: string
        name:
          type: string
        version:
          type: string
      type: object
    types.ExtensionFileView:
      properties:
        arch:
          type: string
        filename:
          type: string
        platform:
          type: string
        sha256:
          type: string
        size:
          type: integer
        updated_at:
          type: string
        updated_by:
          type: string
      type: object
    types.ExtensionSummary:
      properties:
        command_execution:
          type: boolean
        description:
          type: string
        id:
          type: integer
        name:
          type: string
        platforms:
          items:
            type: string
          type: array
        version:
          type: string
      type: object
    types.ExtensionUpdateRequest:
      properties:
        command_execution:
          type: boolean
        description:
          type: string
        version:
          type: string
      type: object
    types.ExtensionView:
      properties:
        command_execution:
          type: boolean
        created_by:
          type: string
        description:
          type: string
        environments:
          type: integer
        files:
          items:
            $ref: "#/components/schemas/types.ExtensionFileView"
          type: array
        id:
          type: integer
        name:
          type: string
        nodes:
          type: integer
        updated_at:
          type: string
        version:
          type: string
      type: object
    types.GetPermissionsResponse:
      properties:
        permissions:
          additionalProperties:
            $ref: "#/components/schemas/types.EnvAccessView"
          type: object
        username:
          type: string
      type: object
    types.LogSinkCloneRequest:
      properties:
        overwrite:
          type: boolean
        source_environment_id:
          type: integer
        target_environment_id:
          type: integer
      type: object
    types.LogSinkCreateRequest:
      properties:
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        enabled:
          type: boolean
        environment_id:
          type: integer
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        type:
          type: string
      type: object
    types.LogSinkFieldSpec:
      properties:
        default: {}
        help:
          type: string
        label:
          type: string
        name:
          type: string
        options:
          items:
            type: string
          type: array
        placeholder:
          type: string
        required:
          type: boolean
        secret:
          type: boolean
        type:
          type: string
      type: object
    types.LogSinkTypeSpec:
      properties:
        categories:
          items:
            type: string
          type: array
        description:
          type: string
        fields:
          items:
            $ref: "#/components/schemas/types.LogSinkFieldSpec"
          type: array
        has_secret:
          type: boolean
        secret_fields:
          items:
            type: string
          type: array
        type:
          type: string
      type: object
    types.LogSinkUpdateRequest:
      properties:
        categories:
          items:
            type: string
          type: array
        config:
          type: object
        enabled:
          type: boolean
        info:
          type: string
        name:
          type: string
        order:
          type: integer
        type:
          type: string
      type: object
    types.LoginEnvironment:
      properties:
        name:
          type: string
        uuid:
          type: string
      type: object
    types.NodeConfigRequest:
      properties:
        expires_at:
          type: string
        override:
          type: string
      type: object
    types.NodeConfigResponse:
      properties:
        applied:
          type: string
        environment:
          type: string
        expired:
          type: boolean
        expires_at:
          type: string
        override:
          type: string
        updated_at:
          type: string
        updated_by:
          type: string
      type: object
    types.NodeEnrichment:
      properties:
        bios:
          $ref: "#/components/schemas/types.BIOSInfo"
        os:
          $ref: "#/components/schemas/types.OSInfo"
        osquery:
          $ref: "#/components/schemas/types.OsqueryRuntime"
        system:
          $ref: "#/components/schemas/types.SystemInfo"
      type: object
    types.NodeExtensionAssignRequest:
      properties:
        expires_at:
          type: string
      required:
        - expires_at
      type: object
    types.NodeExtensionAssignment:
      properties:
        created_at:
          type: string
        created_by:
          type: string
        expired:
          type: boolean
        expires_at:
          type: string
        extension_id:
          type: integer
        name:
          type: string
      type: object
    types.NodeExtensionEffective:
      properties:
        available:
          type: boolean
        command_execution:
          type: boolean
        name:
          type: string
        platforms:
          items:
            type: string
          type: array
        source:
          type: string
      type: object
    types.NodeExtensionStatusView:
      properties:
        at:
          type: string
        error:
          type: string
        lingering:
          description: Lingering is set by osctrl when osctrld reports a command-execution
            extension as kept (its removal failed) and the node has no unexpired
            assignment for it.
          type: boolean
        name:
          type: string
        reported_at:
          type: string
        result:
          type: string
        sha256:
          type: string
      type: object
    types.NodeExtensionsResponse:
      properties:
        assignments:
          items:
            $ref: "#/components/schemas/types.NodeExtensionAssignment"
          type: array
        effective:
          items:
            $ref: "#/components/schemas/types.NodeExtensionEffective"
          type: array
        library:
          items:
            $ref: "#/components/schemas/types.ExtensionSummary"
          type: array
        status:
          items:
            $ref: "#/components/schemas/types.NodeExtensionStatusView"
          type: array
      type: object
    types.NodeFlagsRequest:
      properties:
        expires_at:
          type: string
        override:
          type: string
      type: object
    types.NodeFlagsResponse:
      properties:
        applied:
          type: string
        conflicts:
          items:
            type: string
          type: array
        environment:
          type: string
        expired:
          type: boolean
        expires_at:
          type: string
        osctrld:
          $ref: "#/components/schemas/types.OsctrldStatusView"
        override:
          type: string
        updated_at:
          type: string
        updated_by:
          type: string
      type: object
    types.NodeHealth:
      properties:
        reason:
          type: string
        signals:
          items:
            type: string
          type: array
        status:
          type: string
      type: object
    types.NodeOsqueryResponse:
      properties:
        available:
          description: Available lists the library version names (no digests), ascending.
          items:
            type: string
          type: array
        installed_version:
          type: string
        pin:
          $ref: "#/components/schemas/types.OsqueryPinView"
        platform_unsupported:
          description: |-
            PlatformUnsupported is true when the node's stored platform has no
            osquery package (for example freebsd), so osctrld cannot upgrade it.
            Windows is supported.
          type: boolean
        rollout:
          allOf:
            - $ref: "#/components/schemas/types.NodeOsqueryRollout"
          description: >-
            Rollout is set only while the environment's staged rollout (running
            or

            paused) is what the node's target comes from; null otherwise.
        target:
          $ref: "#/components/schemas/types.OsqueryEffectiveTarget"
        upgrade:
          $ref: "#/components/schemas/types.OsqueryUpgradeView"
      type: object
    types.NodeOsqueryRollout:
      properties:
        eligible_at:
          type: string
        stage:
          type: integer
        stages:
          items:
            type: integer
          type: array
        state:
          type: string
      type: object
    types.NodePostureSummary:
      properties:
        risk_level:
          type: string
      type: object
    types.NodeUptime:
      properties:
        days:
          type: integer
        hours:
          type: integer
        last_seen:
          type: string
        minutes:
          type: integer
        seconds:
          type: integer
        total_seconds:
          type: integer
      type: object
    types.NodeView:
      properties:
        bytes_received:
          type: integer
        config_hash:
          type: string
        country_code:
          type: string
        cpu:
          type: string
        created_at:
          type: string
        daemon_hash:
          type: string
        environment:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        hardware_serial:
          type: string
        health:
          $ref: "#/components/schemas/types.NodeHealth"
        hostname:
          type: string
        id:
          type: integer
        ip_address:
          type: string
        last_seen:
          type: string
        localname:
          type: string
        memory:
          type: string
        node_key:
          type: string
        osquery_user:
          type: string
        osquery_version:
          type: string
        platform:
          type: string
        platform_version:
          type: string
        posture:
          $ref: "#/components/schemas/types.NodePostureSummary"
        system_info:
          $ref: "#/components/schemas/types.NodeEnrichment"
        tags:
          items:
            $ref: "#/components/schemas/tags.AdminTag"
          type: array
        updated_at:
          type: string
        uptime:
          $ref: "#/components/schemas/types.NodeUptime"
        user_id:
          type: integer
        username:
          type: string
        uuid:
          type: string
      type: object
    types.NodesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.NodeView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.OSInfo:
      properties:
        codename:
          type: string
        major:
          type: string
        minor:
          type: string
        name:
          type: string
        patch:
          type: string
        platform:
          type: string
        platform_like:
          type: string
        version:
          type: string
      type: object
    types.OsctrldStatusView:
      properties:
        apply_at:
          type: string
        apply_error:
          type: string
        apply_result:
          type: string
        down_since:
          type: string
        extensions_stage:
          type: string
        flags_stage:
          type: string
        last_fetched_at:
          type: string
        osquery_running:
          description: >-
            Health report: osquery_running, down_since and the stages come from
            the

            host; reported_at is the server's receive time.
          type: boolean
        rejected_current:
          type: boolean
        report_stale:
          type: boolean
        reported_at:
          type: string
      type: object
    types.OsqueryEffectiveTarget:
      properties:
        source:
          description: pin or environment
          type: string
        version:
          type: string
      type: object
    types.OsqueryEntryRequest:
      properties:
        arch:
          type: string
        format:
          type: string
        platform:
          type: string
        sha256:
          type: string
      type: object
    types.OsqueryPinView:
      properties:
        expires_at:
          type: string
        request_id:
          type: string
        updated_at:
          type: string
        updated_by:
          type: string
        version:
          type: string
      type: object
    types.OsqueryRuntime:
      properties:
        build_distro:
          type: string
        build_platform:
          type: string
        config_valid:
          type: string
        extensions:
          type: string
        start_time:
          type: string
        version:
          type: string
      type: object
    types.OsqueryTable:
      properties:
        cacheable:
          type: boolean
        columns:
          items:
            $ref: "#/components/schemas/types.OsqueryTableColumn"
          type: array
        description:
          type: string
        evented:
          type: boolean
        examples:
          items:
            type: string
          type: array
        filter:
          type: string
        name:
          type: string
        notes:
          type: string
        platforms:
          items:
            type: string
          type: array
        url:
          type: string
      type: object
    types.OsqueryTableColumn:
      properties:
        description:
          type: string
        hidden:
          type: boolean
        index:
          type: boolean
        name:
          type: string
        notes:
          type: string
        required:
          type: boolean
        type:
          type: string
      type: object
    types.OsqueryTargetRequest:
      properties:
        expires_at:
          type: string
        version:
          type: string
      type: object
    types.OsqueryTargetView:
      properties:
        request_id:
          type: string
        updated_at:
          type: string
        updated_by:
          type: string
        version:
          type: string
      type: object
    types.OsqueryUpgradeView:
      properties:
        reason:
          type: string
        reported_at:
          type: string
        request_id:
          type: string
        result:
          type: string
        version:
          type: string
      type: object
    types.OsqueryVersionEntry:
      properties:
        arch:
          type: string
        created_at:
          type: string
        created_by:
          type: string
        format:
          type: string
        platform:
          type: string
        sha256:
          type: string
      type: object
    types.OsqueryVersionHostCount:
      properties:
        count:
          type: integer
        version:
          type: string
      type: object
    types.OsqueryVersionPutRequest:
      properties:
        entries:
          items:
            $ref: "#/components/schemas/types.OsqueryEntryRequest"
          type: array
      type: object
    types.OsqueryVersionView:
      properties:
        entries:
          items:
            $ref: "#/components/schemas/types.OsqueryVersionEntry"
          type: array
        in_use:
          type: boolean
        version:
          type: string
      type: object
    types.PasswordChangeRequest:
      properties:
        current_password:
          type: string
        new_password:
          type: string
      type: object
    types.QueriesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/queries.DistributedQuery"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.QueryResultsResponse:
      properties:
        items:
          items:
            additionalProperties: {}
            type: object
          type: array
        page:
          type: integer
        page_size:
          type: integer
        since:
          type: string
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.QueryTargetView:
      properties:
        type:
          type: string
        value:
          type: string
      type: object
    types.SavedQueriesPagedResponse:
      properties:
        items:
          items:
            $ref: "#/components/schemas/types.SavedQueryView"
          type: array
        page:
          type: integer
        page_size:
          type: integer
        total_items:
          type: integer
        total_pages:
          type: integer
      type: object
    types.SavedQueryCreateRequest:
      properties:
        name:
          type: string
        query:
          type: string
      type: object
    types.SavedQueryUpdateRequest:
      properties:
        query:
          type: string
      type: object
    types.SavedQueryView:
      properties:
        created_at:
          type: string
        creator:
          type: string
        environment_id:
          type: integer
        extra_data:
          type: string
        id:
          type: integer
        name:
          type: string
        query:
          type: string
        updated_at:
          type: string
      type: object
    types.ServiceCommandResponse:
      properties:
        action:
          type: string
        command_id:
          type: string
        consumed_at:
          type: string
        consumed_by:
          type: string
        created_at:
          type: string
        expires_at:
          type: string
        recovered_at:
          type: string
        recovered_by:
          type: string
        requested_by:
          type: string
        requested_from:
          type: string
        status:
          type: string
        target_service:
          type: string
      type: object
    types.ServiceConfigApplyResponse:
      properties:
        command:
          $ref: "#/components/schemas/types.ServiceCommandResponse"
        message:
          type: string
        service:
          type: string
      type: object
    types.ServiceConfigPersistRequest:
      properties:
        service:
          type: string
      type: object
    types.ServiceConfigPersistResponse:
      properties:
        command:
          $ref: "#/components/schemas/types.ServiceCommandResponse"
        message:
          type: string
        service:
          type: string
      type: object
    types.ServiceConfigStatusResponse:
      properties:
        checked_at:
          type: string
        file_path:
          type: string
        file_reason:
          type: string
        file_writable:
          type: boolean
        pending_changes:
          type: boolean
        service:
          type: string
      type: object
    types.ServiceConfigUpdateRequest:
      properties:
        patch:
          type: object
        reset:
          items:
            type: string
          type: array
        value:
          type: object
      type: object
    types.SetPermissionsAllRequest:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
      type: object
    types.SetPermissionsAllResponse:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
        total:
          type: integer
        updated:
          type: integer
      type: object
    types.SetPermissionsRequest:
      properties:
        access:
          $ref: "#/components/schemas/types.EnvAccessView"
        env_uuid:
          type: string
      type: object
    types.SettingPatchRequest:
      properties:
        boolean:
          type: boolean
        integer:
          type: integer
        string:
          type: string
        type:
          type: string
      type: object
    types.SystemInfo:
      properties:
        computer_name:
          type: string
        cpu_brand:
          type: string
        cpu_logical_cores:
          type: string
        cpu_physical_cores:
          type: string
        cpu_subtype:
          type: string
        cpu_type:
          type: string
        hardware_model:
          type: string
        hardware_serial:
          type: string
        hardware_vendor:
          type: string
        hardware_version:
          type: string
        local_hostname:
          type: string
        physical_memory:
          type: string
      type: object
    types.TLSEnvironmentView:
      properties:
        accept_enrolls:
          type: boolean
        carves_tls:
          type: boolean
        config_interval:
          type: integer
        config_tls:
          type: boolean
        created_at:
          type: string
        debug_http:
          type: boolean
        enroll_expire:
          type: string
        hostname:
          type: string
        icon:
          type: string
        id:
          type: integer
        log_interval:
          type: integer
        logging_tls:
          type: boolean
        name:
          type: string
        query_interval:
          type: integer
        query_tls:
          type: boolean
        remove_expire:
          type: string
        type:
          type: string
        updated_at:
          type: string
        uuid:
          type: string
      type: object
    types.TokenResponse:
      properties:
        expires:
          type: string
        token:
          type: string
      type: object
    types.UserMePatchRequest:
      properties:
        email:
          type: string
        fullname:
          type: string
        preferred_language:
          description: |-
            PreferredLanguage is the UI language tag the operator picked.
            Validated against the supported-language list; an empty value
            leaves the stored preference unchanged (same semantics as the
            other patch fields).
          type: string
      type: object
    types.UserMeResponse:
      properties:
        admin:
          type: boolean
        alert_admin:
          type: boolean
        email:
          type: string
        env_manager:
          type: boolean
        fullname:
          type: string
        last_access:
          type: string
        permissions:
          additionalProperties:
            $ref: "#/components/schemas/types.EnvAccessView"
          type: object
        preferred_language:
          description: |-
            PreferredLanguage mirrors AdminUser.PreferredLanguage — the
            UI language the operator picked. Empty means "no server-side
            preference"; the SPA falls back to its own detection.
          type: string
        read_only_admin:
          type: boolean
        service:
          type: boolean
        token_expire:
          type: string
        user_admin:
          type: boolean
        username:
          type: string
        uuid:
          type: string
      type: object
    vulns.Advisory:
      properties:
        cvss_from:
          description: |-
            CVSSFrom is the aliased NVD CVE an OSV record without its own CVSS
            borrowed its score from. Empty when the score is the record's own.
          type: string
        cvss_score:
          type: number
        cvss_vector:
          type: string
        details:
          type: string
        id:
          type: string
        kev:
          type: boolean
        modified:
          type: string
        published:
          type: string
        severity:
          type: string
        source:
          description: |-
            Source is the feed that owns the record. Existing rows predate NVD
            support and are OSV records.
          type: string
        summary:
          type: string
      type: object
    vulns.AdvisoryDetail:
      properties:
        advisory:
          $ref: "#/components/schemas/vulns.Advisory"
        aliases:
          items:
            type: string
          type: array
        findings:
          items:
            $ref: "#/components/schemas/vulns.Finding"
          type: array
        references:
          items:
            type: string
          type: array
      type: object
    vulns.CountRow:
      properties:
        name:
          type: string
        total:
          type: integer
      type: object
    vulns.FeedStatus:
      properties:
        last_sync_at:
          type: string
        last_sync_failed:
          type: boolean
        loaded:
          type: boolean
        sources:
          items:
            $ref: "#/components/schemas/vulns.SyncState"
          type: array
        stale:
          type: boolean
        sync_requested_at:
          type: string
      type: object
    vulns.Finding:
      properties:
        advisory_id:
          type: string
        confidence:
          type: string
        ecosystem:
          type: string
        environment_id:
          type: integer
        first_seen:
          type: string
        fixed_version:
          type: string
        id:
          type: integer
        installed_version:
          type: string
        kev:
          type: boolean
        last_seen:
          type: string
        node_uuid:
          type: string
        package:
          type: string
        resolved_at:
          type: string
        severity:
          type: string
      type: object
    vulns.NodeReport:
      properties:
        findings:
          items:
            $ref: "#/components/schemas/vulns.Finding"
          type: array
        inventory_at:
          type: string
        loaded:
          type: boolean
        matched_at:
          type: string
        not_assessed:
          type: integer
        stale:
          type: boolean
      type: object
    vulns.Summary:
      properties:
        affected_nodes:
          type: integer
        by_severity:
          additionalProperties:
            additionalProperties:
              format: int64
              type: integer
            type: object
          type: object
        kev:
          type: integer
        kev_possible:
          description: KEVPossible counts open possible findings that are known-exploited.
          type: integer
        loaded:
          type: boolean
        not_assessed:
          type: integer
        possible:
          description: |-
            Possible counts open possible (NVD CPE) findings. KEV, AffectedNodes
            and the top lists count confirmed findings only.
          type: integer
        stale:
          type: boolean
        top_advisories:
          items:
            $ref: "#/components/schemas/vulns.CountRow"
          type: array
        top_packages:
          items:
            $ref: "#/components/schemas/vulns.CountRow"
          type: array
      type: object
    vulns.SyncState:
      properties:
        cursor:
          type: string
        last_error:
          type: string
        last_error_at:
          type: string
        last_skipped:
          type: integer
        last_success:
          type: string
        last_written:
          type: integer
        source:
          type: string
      type: object