{ "components": { "parameters": { "APIKeyID": { "description": "API key id.", "in": "path", "name": "id", "required": true, "schema": { "type": "string" } }, "AuditConsumer": { "description": "Filter by who ran the command.", "in": "query", "name": "consumer", "required": false, "schema": { "enum": [ "human", "ai", "ci" ], "type": "string" } }, "AuditDecision": { "description": "Filter by policy decision.", "in": "query", "name": "decision", "required": false, "schema": { "enum": [ "ALLOWED", "DENIED", "allowed", "denied" ], "type": "string" } }, "AuditProvider": { "description": "Filter by provider.", "example": "github", "in": "query", "name": "provider", "required": false, "schema": { "type": "string" } }, "AuditQ": { "description": "Case-insensitive substring across command, executor, resource, provider, and capability.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, "CapabilityProvider": { "description": "Only capabilities belonging to this provider.", "example": "github", "in": "query", "name": "provider", "required": false, "schema": { "type": "string" } }, "CapabilityQuery": { "description": "Substring across capability name, description, id, and provider.", "in": "query", "name": "q", "required": false, "schema": { "type": "string" } }, "Limit": { "description": "Page size. Clamped to 1000.", "in": "query", "name": "limit", "required": false, "schema": { "default": 100, "maximum": 1000, "minimum": 1, "type": "integer" } }, "Offset": { "description": "Rows to skip.", "in": "query", "name": "offset", "required": false, "schema": { "default": 0, "minimum": 0, "type": "integer" } }, "PolicyActive": { "description": "`true` returns the single active policy instead of a list.", "example": "true", "in": "query", "name": "active", "required": false, "schema": { "enum": [ "true" ], "type": "string" } }, "PolicyVersion": { "description": "Policy version name.", "example": "v12", "in": "path", "name": "version", "required": true, "schema": { "type": "string" } }, "RuntimeClient": { "description": "Runtime client identity. Present on any value, it has the same effect as `active=true`.", "example": "engineering-runtime", "in": "header", "name": "X-Runtime-Client", "required": false, "schema": { "type": "string" } } }, "requestBodies": { "APIKeyCreate": { "content": { "application/json": { "example": { "name": "ci-runner", "scopes": "runtime" }, "schema": { "$ref": "#/components/schemas/APIKeyCreate" } } }, "required": true }, "AuditIngest": { "content": { "application/json": { "example": { "command": "github repo list", "consumer": "human", "duration_ms": 84, "executor": "kishore", "policy_decision": "ALLOWED", "provider": "github", "status": "success" }, "schema": { "$ref": "#/components/schemas/AuditIngest" } } }, "required": true }, "Heartbeat": { "content": { "application/json": { "example": { "hostname": "gh-runner-7", "name": "ci-runner-01", "os": "linux", "policy_version": "v12", "version": "0.9.3" }, "schema": { "$ref": "#/components/schemas/Heartbeat" } } }, "required": true }, "Login": { "content": { "application/json": { "example": { "email": "YOUR_EMAIL", "password": "YOUR_PASSWORD" }, "schema": { "$ref": "#/components/schemas/LoginRequest" } } }, "required": true }, "PolicyPublish": { "content": { "application/json": { "example": { "description": "Deny production writes outside change windows", "name": "enterprise-policy", "updated_by": "kishore", "version": "v13", "yaml": "version: v13\nrules:\n - id: deny-prod-write\n effect: deny\n" }, "schema": { "$ref": "#/components/schemas/PolicyPublish" } } }, "required": true }, "RuntimeRegister": { "content": { "application/json": { "example": { "hostname": "gh-runner-7", "name": "ci-runner-01", "os": "linux", "version": "0.9.3" }, "schema": { "$ref": "#/components/schemas/RuntimeRegister" } } }, "required": true } }, "responses": { "BadRequest": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "The request body or parameters were rejected." }, "Conflict": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "That policy version already exists — versions are immutable." }, "NotFound": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "No such record." }, "ServerError": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "Server or database failure." }, "Unauthorized": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "Credentials are required, or the ones supplied were rejected." } }, "schemas": { "APIKey": { "properties": { "created_at": { "format": "date-time", "type": "string" }, "id": { "type": "string" }, "last_used_at": { "format": "date-time", "type": "string" }, "name": { "type": "string" }, "prefix": { "description": "First characters of the key — enough to identify it, not to use it.", "type": "string" }, "revoked": { "type": "boolean" }, "scopes": { "default": "runtime", "type": "string" } }, "type": "object" }, "APIKeyCreate": { "properties": { "name": { "type": "string" }, "scopes": { "default": "runtime", "type": "string" } }, "required": [ "name" ], "type": "object" }, "APIKeyCreated": { "allOf": [ { "$ref": "#/components/schemas/APIKey" }, { "properties": { "api_key": { "description": "Plaintext key. Shown once — only the hash is stored.", "type": "string" }, "warning": { "type": "string" } }, "type": "object" } ] }, "APIKeyList": { "properties": { "api_keys": { "items": { "$ref": "#/components/schemas/APIKey" }, "type": "array" } }, "type": "object" }, "AuditBatchResult": { "properties": { "accepted": { "type": "integer" }, "events": { "items": { "$ref": "#/components/schemas/AuditEvent" }, "type": "array" } }, "type": "object" }, "AuditEvent": { "properties": { "ai": { "type": "boolean" }, "capability": { "type": "string" }, "command": { "example": "github repo list", "type": "string" }, "consumer": { "default": "human", "enum": [ "human", "ai", "ci" ], "type": "string" }, "duration_ms": { "type": "integer" }, "executor": { "example": "kishore", "type": "string" }, "id": { "type": "string" }, "ingested_at": { "format": "date-time", "type": "string" }, "message": { "type": "string" }, "organization_id": { "type": "string" }, "policy": { "description": "Policy version that decided this command.", "type": "string" }, "policy_decision": { "enum": [ "ALLOWED", "DENIED" ], "type": "string" }, "provider": { "example": "github", "type": "string" }, "reason": { "type": "string" }, "resource": { "type": "string" }, "runtime_context": { "type": "string" }, "runtime_name": { "type": "string" }, "runtime_version": { "type": "string" }, "status": { "example": "success", "type": "string" }, "timestamp": { "format": "date-time", "type": "string" }, "trace_id": { "type": "string" }, "transport": { "type": "string" } }, "type": "object" }, "AuditIngest": { "description": "One event, or `{\"events\":[…]}`. camelCase aliases (`user`, `tool`,\n`repository`, `decision`, `runtimeVersion`, `runtimeName`,\n`policyVersion`, `traceId`, `durationMs`, `ai`) are accepted for\ncompatibility with older runtime builds.\n", "oneOf": [ { "$ref": "#/components/schemas/AuditEvent" }, { "properties": { "events": { "items": { "$ref": "#/components/schemas/AuditEvent" }, "type": "array" } }, "required": [ "events" ], "type": "object" } ] }, "AuditPage": { "properties": { "events": { "items": { "$ref": "#/components/schemas/AuditEvent" }, "type": "array" }, "limit": { "type": "integer" }, "offset": { "type": "integer" }, "returned": { "type": "integer" }, "total": { "description": "Matching rows before paging.", "type": "integer" } }, "type": "object" }, "BuildInfo": { "properties": { "build_time": { "type": "string" }, "commit": { "type": "string" }, "go": { "type": "string" }, "started_at": { "format": "date-time", "type": "string" }, "uptime_seconds": { "type": "integer" }, "version": { "type": "string" } }, "type": "object" }, "Capability": { "properties": { "description": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "path": { "type": "string" }, "provider": { "type": "string" } }, "type": "object" }, "CapabilityList": { "properties": { "capabilities": { "items": { "$ref": "#/components/schemas/Capability" }, "type": "array" }, "catalog": { "type": "string" }, "generated_at": { "type": "string" }, "total": { "type": "integer" } }, "type": "object" }, "CatalogCapabilities": { "allOf": [ { "$ref": "#/components/schemas/CatalogEnvelope" }, { "properties": { "capabilities": { "items": { "$ref": "#/components/schemas/CatalogCapabilityRow" }, "type": "array" }, "total": { "description": "Rows after filtering.", "type": "integer" } }, "type": "object" } ] }, "CatalogCapabilityRow": { "properties": { "description": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "path": { "description": "Source path within the runtime repository.", "type": "string" }, "provider": { "type": "string" } }, "type": "object" }, "CatalogContract": { "allOf": [ { "$ref": "#/components/schemas/CatalogEnvelope" }, { "properties": { "contracts": { "additionalProperties": { "type": "string" }, "type": "object" }, "description": { "type": "string" }, "documentation": { "type": "string" }, "tenant_view": { "additionalProperties": { "type": "string" }, "description": "Where to get the org-scoped view instead, and why it differs.", "type": "object" } }, "type": "object" } ] }, "CatalogEnvelope": { "description": "Repeated on every contract response, so one request is enough to know what you are holding.", "properties": { "contract_version": { "description": "Compatibility promise. Additive changes bump the minor; removals or renames bump the major. A catalog generated before versioning existed reports \"0\".", "example": "1.0", "type": "string" }, "counts": { "properties": { "capabilities": { "type": "integer" }, "providers": { "type": "integer" } }, "type": "object" }, "generated_at": { "format": "date-time", "type": "string" }, "runtime": { "$ref": "#/components/schemas/CatalogProvenance" }, "source": { "description": "Which catalog document answered — `embed`, `file:…` or `url:…`.", "type": "string" } }, "type": "object" }, "CatalogProvenance": { "description": "Which commit of engineering-runtime the catalog was built from. Absence is meaningful — see `known`.", "properties": { "commit": { "description": "Full SHA the catalog was generated from.", "type": "string" }, "known": { "description": "False when the catalog was generated without a runtime checkout. The commit is then absent rather than guessed — an unknown provenance is stated, never defaulted.", "type": "boolean" }, "note": { "description": "Present only when `known` is false.", "type": "string" }, "ref": { "example": "main", "type": "string" }, "repo": { "example": "engineering-runtime", "type": "string" }, "short_commit": { "example": "38eec00", "type": "string" } }, "type": "object" }, "CatalogProviderRow": { "description": "A provider as the runtime defines it — no status, no tenant.", "properties": { "auth": { "type": "string" }, "capabilities": { "description": "How many capabilities target this provider.", "type": "integer" }, "id": { "example": "github", "type": "string" }, "name": { "example": "GitHub", "type": "string" }, "operation_names": { "items": { "type": "string" }, "type": "array" }, "operations": { "type": "integer" } }, "type": "object" }, "CatalogProviders": { "allOf": [ { "$ref": "#/components/schemas/CatalogEnvelope" }, { "properties": { "providers": { "items": { "$ref": "#/components/schemas/CatalogProviderRow" }, "type": "array" }, "total": { "type": "integer" } }, "type": "object" } ] }, "Dashboard": { "properties": { "ai_commands_today": { "description": "Same value as `ai_operations`, under the field name the demo UI reads.", "type": "integer" }, "ai_operations": { "type": "integer" }, "allowed_today": { "type": "integer" }, "by_provider": { "additionalProperties": { "type": "integer" }, "type": "object" }, "capabilities": { "type": "integer" }, "commands_today": { "description": "Commands in the last 24 hours.", "type": "integer" }, "denied_today": { "type": "integer" }, "policy_version": { "type": "string" }, "providers": { "type": "integer" }, "recent_audit": { "items": { "$ref": "#/components/schemas/AuditEvent" }, "type": "array" }, "runtimes_online": { "type": "integer" }, "runtimes_total": { "type": "integer" } }, "type": "object" }, "Error": { "properties": { "error": { "description": "Human-readable failure reason.", "type": "string" } }, "required": [ "error" ], "type": "object" }, "FleetList": { "properties": { "runtimes": { "items": { "$ref": "#/components/schemas/RuntimeInstance" }, "type": "array" } }, "type": "object" }, "Health": { "properties": { "edition": { "example": "enterprise", "type": "string" }, "status": { "example": "ok", "type": "string" } }, "type": "object" }, "Heartbeat": { "properties": { "hostname": { "type": "string" }, "name": { "description": "Stable runtime name. Upsert key together with the organisation.", "type": "string" }, "os": { "type": "string" }, "policy_version": { "type": "string" }, "version": { "type": "string" } }, "required": [ "name" ], "type": "object" }, "LoginRequest": { "properties": { "email": { "format": "email", "type": "string" }, "password": { "format": "password", "type": "string" } }, "required": [ "email", "password" ], "type": "object" }, "LoginResult": { "properties": { "expires_at": { "format": "date-time", "type": "string" }, "token": { "description": "JWT for `Authorization: Bearer`.", "type": "string" }, "user": { "$ref": "#/components/schemas/User" } }, "type": "object" }, "Metadata": { "description": "What this host is, which surfaces it exposes, and where its contracts live.", "properties": { "base_url": { "type": "string" }, "catalog": { "additionalProperties": true, "type": "object" }, "contracts": { "additionalProperties": { "type": "string" }, "type": "object" }, "description": { "type": "string" }, "environment": { "type": "string" }, "health": { "type": "string" }, "metadata": { "additionalProperties": { "type": "string" }, "type": "object" }, "portal": { "additionalProperties": { "type": "string" }, "type": "object" }, "service": { "type": "string" }, "surfaces": { "items": { "$ref": "#/components/schemas/Surface" }, "type": "array" }, "version": { "$ref": "#/components/schemas/BuildInfo" } }, "type": "object" }, "MetadataAPIs": { "properties": { "base_url": { "type": "string" }, "by_surface": { "additionalProperties": { "type": "integer" }, "type": "object" }, "contract": { "type": "string" }, "operations": { "items": { "properties": { "auth": { "type": "string" }, "method": { "type": "string" }, "path": { "type": "string" }, "summary": { "type": "string" }, "surface": { "enum": [ "public", "v1", "portal" ], "type": "string" }, "tags": { "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "type": "array" }, "total": { "type": "integer" } }, "type": "object" }, "MetadataAuthentication": { "properties": { "api_keys_accepted": { "type": "boolean" }, "documentation": { "type": "string" }, "environment": { "type": "string" }, "require_auth": { "description": "Whether this process enforces credentials on `/api/v1`.", "type": "boolean" }, "runtime_client_header": { "type": "string" }, "schemes": { "items": { "additionalProperties": true, "type": "object" }, "type": "array" }, "surfaces": { "items": { "$ref": "#/components/schemas/Surface" }, "type": "array" } }, "type": "object" }, "MetadataVersions": { "properties": { "api_surfaces": { "items": { "properties": { "prefix": { "type": "string" }, "status": { "type": "string" }, "version": { "type": "string" } }, "type": "object" }, "type": "array" }, "build": { "$ref": "#/components/schemas/BuildInfo" }, "catalog": { "additionalProperties": true, "type": "object" }, "environment": { "type": "string" }, "openapi": { "properties": { "api_version": { "example": "v1", "type": "string" }, "spec": { "example": "3.1.0", "type": "string" } }, "type": "object" } }, "type": "object" }, "Organization": { "properties": { "created_at": { "format": "date-time", "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "slug": { "type": "string" }, "updated_at": { "format": "date-time", "type": "string" } }, "type": "object" }, "OrganizationList": { "properties": { "organizations": { "items": { "$ref": "#/components/schemas/Organization" }, "type": "array" } }, "type": "object" }, "Policy": { "properties": { "active": { "type": "boolean" }, "description": { "type": "string" }, "name": { "example": "enterprise-policy", "type": "string" }, "updated_at": { "format": "date-time", "type": "string" }, "updated_by": { "type": "string" }, "version": { "example": "v12", "type": "string" }, "yaml": { "description": "The policy document the runtime caches and evaluates locally.", "type": "string" } }, "type": "object" }, "PolicyList": { "properties": { "active": { "description": "Version name of the active policy.", "type": "string" }, "policies": { "items": { "$ref": "#/components/schemas/Policy" }, "type": "array" } }, "type": "object" }, "PolicyPublish": { "properties": { "description": { "type": "string" }, "name": { "default": "enterprise-policy", "type": "string" }, "updated_by": { "description": "Defaults to the authenticated user, or `portal-api`.", "type": "string" }, "version": { "description": "Omit to generate one from the UTC timestamp.", "type": "string" }, "yaml": { "description": "Policy document. Validated before storage.", "type": "string" } }, "required": [ "yaml" ], "type": "object" }, "Provider": { "properties": { "auth": { "type": "string" }, "capabilities": { "type": "integer" }, "id": { "example": "github", "type": "string" }, "last_used": { "format": "date-time", "type": "string" }, "name": { "example": "GitHub", "type": "string" }, "operations": { "type": "integer" }, "scope": { "type": "string" }, "status": { "description": "Derived per request from recent audit activity unless a stored row overrides it.", "enum": [ "connected", "offline", "degraded" ], "type": "string" } }, "type": "object" }, "ProviderList": { "properties": { "catalog": { "description": "Which catalog document answered — `embed`, `file:…`, or `url:…`.", "type": "string" }, "generated_at": { "type": "string" }, "providers": { "items": { "$ref": "#/components/schemas/Provider" }, "type": "array" } }, "type": "object" }, "ProviderNames": { "properties": { "providers": { "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "RegisterResult": { "properties": { "name": { "type": "string" }, "runtimeId": { "type": "string" }, "status": { "example": "registered", "type": "string" } }, "type": "object" }, "RevokeResult": { "properties": { "id": { "type": "string" }, "status": { "example": "revoked", "type": "string" } }, "type": "object" }, "RuntimeInstance": { "properties": { "hostname": { "type": "string" }, "last_seen": { "format": "date-time", "type": "string" }, "name": { "example": "ci-runner-01", "type": "string" }, "os": { "type": "string" }, "policy_version": { "type": "string" }, "status": { "enum": [ "online", "idle", "offline" ], "type": "string" }, "version": { "type": "string" } }, "type": "object" }, "RuntimeRegister": { "properties": { "hostname": { "type": "string" }, "name": { "type": "string" }, "os": { "type": "string" }, "version": { "type": "string" } }, "required": [ "name" ], "type": "object" }, "Settings": { "properties": { "auth": { "additionalProperties": true, "type": "object" }, "edition": { "example": "enterprise", "type": "string" }, "organization_id": { "type": "string" }, "settings": { "items": { "properties": { "key": { "type": "string" }, "value": { "type": "string" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "StatusOK": { "properties": { "status": { "example": "ok", "type": "string" } }, "type": "object" }, "Surface": { "properties": { "audience": { "type": "string" }, "auth": { "description": "Reported from live configuration, not from documentation.", "type": "string" }, "prefix": { "example": "/api/public", "type": "string" }, "stable": { "type": "boolean" } }, "type": "object" }, "User": { "properties": { "active": { "type": "boolean" }, "email": { "format": "email", "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "organization_id": { "type": "string" }, "role": { "enum": [ "admin", "operator", "viewer" ], "type": "string" } }, "type": "object" }, "UserList": { "properties": { "users": { "items": { "$ref": "#/components/schemas/User" }, "type": "array" } }, "type": "object" }, "VersionInfo": { "properties": { "build_time": { "type": "string" }, "commit": { "type": "string" }, "environment": { "example": "production", "type": "string" }, "go": { "example": "go1.23.0", "type": "string" }, "service": { "example": "engineering-runtime-app-api", "type": "string" }, "started_at": { "format": "date-time", "type": "string" }, "surfaces": { "items": { "type": "string" }, "type": "array" }, "uptime_seconds": { "type": "integer" }, "version": { "example": "dev", "type": "string" } }, "type": "object" } }, "securitySchemes": { "apiKeyAuth": { "description": "Runtime key (`erk_…`) created by `POST /api/v1/api-keys`. Accepted on runtime contract routes.", "in": "header", "name": "X-API-Key", "type": "apiKey" }, "bearerAuth": { "bearerFormat": "JWT", "description": "Issued by `POST /api/v1/auth/login`. Enforced when `REQUIRE_AUTH=true`.", "scheme": "bearer", "type": "http" } } }, "info": { "contact": { "name": "Engineering Runtime", "url": "https://api.engineeringruntime.com/" }, "description": "One API serves three consumers: the `runtime` CLI (portal client), the demo\nControl Plane UI, and the enterprise app UI.\n\nTwo prefixes expose the same handlers to different audiences.\n`/api/public` is always open and backs Community runtimes and the demo.\n`/api/v1` additionally carries login and organisation management, and\nenforces JWT / API-key auth when the deployment sets `REQUIRE_AUTH=true`.\n\nThe runtime uses exactly three of these routes — `GET {prefix}/policies?active=true`,\n`POST {prefix}/audit`, `POST {prefix}/fleet/heartbeat`. Policy is evaluated\nlocally against a cached file, so the runtime keeps working when this API is\nunreachable.\n", "summary": "Policies, audit, fleet, and catalog for Engineering Runtime.", "title": "Engineering Runtime Control Plane API", "version": "v1" }, "openapi": "3.1.0", "paths": { "/": { "get": { "description": "Content-negotiated. `Accept: text/html` returns the API portal;\nanything else (including `*/*`) returns the same document as\n`GET /metadata`. HTML is served only when the caller asks for it more\nspecifically than for JSON.\n", "operationId": "getRoot", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Metadata" } }, "text/html": { "schema": { "type": "string" } } }, "description": "Metadata document, or the portal home page for browsers." } }, "security": [], "summary": "API home — website for browsers, metadata for tools", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/api/public/audit": { "get": { "operationId": "listPublicAudit", "parameters": [ { "$ref": "#/components/parameters/AuditQ" }, { "$ref": "#/components/parameters/AuditDecision" }, { "$ref": "#/components/parameters/AuditProvider" }, { "$ref": "#/components/parameters/AuditConsumer" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Offset" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditPage" } } }, "description": "A page of events, newest first." }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Query audit events", "tags": [ "Audit" ], "x-er-auth": "none" }, "post": { "description": "Accepts one event object, or `{\"events\":[…]}` for a batch. camelCase\naliases from older runtime builds are accepted alongside the canonical\nfields. Answers 202 — the runtime's local record was already\nauthoritative.\n", "operationId": "ingestPublicAudit", "requestBody": { "$ref": "#/components/requestBodies/AuditIngest" }, "responses": { "202": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/AuditEvent" }, { "$ref": "#/components/schemas/AuditBatchResult" } ] } } }, "description": "Stored. A single event echoes the record; a batch echoes `accepted` and the records." }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Ingest audit events", "tags": [ "Audit" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/capabilities": { "get": { "operationId": "listPublicCapabilities", "parameters": [ { "$ref": "#/components/parameters/CapabilityProvider" }, { "$ref": "#/components/parameters/CapabilityQuery" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CapabilityList" } } }, "description": "Capabilities." } }, "security": [], "summary": "List capabilities", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/dashboard": { "get": { "operationId": "getPublicDashboard", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Dashboard" } } }, "description": "Aggregates over the last 24 hours plus catalog and fleet counts." } }, "security": [], "summary": "Summary cards", "tags": [ "Dashboard" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/fleet": { "get": { "description": "Status is derived from `last_seen`: online under 15 minutes, idle under 24 hours, offline beyond.", "operationId": "listPublicFleet", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetList" } } }, "description": "Runtimes, most recently seen first." }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "List known runtimes", "tags": [ "Fleet" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/fleet/heartbeat": { "post": { "description": "Upserts on (organisation, name), so a runtime reporting often keeps one row.", "operationId": "publicFleetHeartbeat", "requestBody": { "$ref": "#/components/requestBodies/Heartbeat" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StatusOK" } } }, "description": "Recorded." }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Report runtime presence", "tags": [ "Fleet" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/health": { "get": { "operationId": "getPublicHealth", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } }, "description": "The service is up." } }, "security": [], "summary": "Health (public surface)", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/policies": { "get": { "description": "With `active=true` — or an `X-Runtime-Client` header — returns the single\nactive policy document. Otherwise returns every version for the\norganisation plus the active version name.\n", "operationId": "listPublicPolicies", "parameters": [ { "$ref": "#/components/parameters/PolicyActive" }, { "$ref": "#/components/parameters/RuntimeClient" } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/PolicyList" }, { "$ref": "#/components/schemas/Policy" } ] } } }, "description": "A policy list, or a single active policy." }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "List policies, or fetch the active one", "tags": [ "Policy" ], "x-er-auth": "none" }, "post": { "description": "Validates the YAML, deactivates the current active version, and stores\nthis one as active — in a single transaction. Versions are immutable:\nre-publishing an existing version returns 409 so audit records stay\nresolvable.\n", "operationId": "publishPublicPolicy", "requestBody": { "$ref": "#/components/requestBodies/PolicyPublish" }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Policy" } } }, "description": "The published policy, now active." }, "400": { "$ref": "#/components/responses/BadRequest" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Publish a new policy version", "tags": [ "Policy" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/policies/{version}": { "get": { "operationId": "getPublicPolicyVersion", "parameters": [ { "$ref": "#/components/parameters/PolicyVersion" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Policy" } } }, "description": "The requested version." }, "404": { "$ref": "#/components/responses/NotFound" } }, "security": [], "summary": "Fetch one policy version", "tags": [ "Policy" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/provider-names": { "get": { "description": "Catalog provider keys unioned with providers observed in audit.", "operationId": "listPublicProviderNames", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderNames" } } }, "description": "Sorted provider names." }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Provider names for filter dropdowns", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/providers": { "get": { "description": "Catalog rows merged with status derived from recent audit activity.", "operationId": "listPublicProviders", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderList" } } }, "description": "Providers." }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "List providers with live status", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/runtime/heartbeat": { "post": { "description": "Identical to `/api/public/fleet/heartbeat`. Kept for older runtime builds.", "operationId": "publicRuntimeHeartbeat", "requestBody": { "$ref": "#/components/requestBodies/Heartbeat" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StatusOK" } } }, "description": "Recorded." }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Report runtime presence (alias)", "tags": [ "Fleet" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/public/runtime/register": { "post": { "description": "Optional first-contact call. Heartbeats alone are enough to appear in the fleet.", "operationId": "publicRuntimeRegister", "requestBody": { "$ref": "#/components/requestBodies/RuntimeRegister" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterResult" } } }, "description": "An existing runtime was updated." }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterResult" } } }, "description": "A new runtime was registered." }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/ServerError" } }, "security": [], "summary": "Register a runtime", "tags": [ "Fleet" ], "x-er-auth": "none" }, "x-er-surface": "public" }, "/api/v1/api-keys": { "get": { "description": "Key hashes are never returned. `last_used_at` shows which keys are still in use.", "operationId": "listAPIKeys", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIKeyList" } } }, "description": "API keys." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List runtime API keys", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "post": { "description": "The plaintext key is returned once and never again — only its hash is stored.", "operationId": "createAPIKey", "requestBody": { "$ref": "#/components/requestBodies/APIKeyCreate" }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIKeyCreated" } } }, "description": "The created key, including its plaintext value." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Create a runtime API key", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/api-keys/{id}": { "delete": { "description": "Takes effect on the next request using that key.", "operationId": "revokeAPIKey", "parameters": [ { "$ref": "#/components/parameters/APIKeyID" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevokeResult" } } }, "description": "Revoked." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Revoke an API key", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/audit": { "get": { "operationId": "listAudit", "parameters": [ { "$ref": "#/components/parameters/AuditQ" }, { "$ref": "#/components/parameters/AuditDecision" }, { "$ref": "#/components/parameters/AuditProvider" }, { "$ref": "#/components/parameters/AuditConsumer" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Offset" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditPage" } } }, "description": "A page of events, newest first." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Query audit events", "tags": [ "Audit" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "post": { "operationId": "ingestAudit", "requestBody": { "$ref": "#/components/requestBodies/AuditIngest" }, "responses": { "202": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/AuditEvent" }, { "$ref": "#/components/schemas/AuditBatchResult" } ] } } }, "description": "Stored." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Ingest audit events", "tags": [ "Audit" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/auth/login": { "post": { "operationId": "login", "requestBody": { "$ref": "#/components/requestBodies/Login" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LoginResult" } } }, "description": "A token and the authenticated user." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" } }, "security": [], "summary": "Exchange credentials for a JWT", "tags": [ "Authentication" ], "x-er-auth": "none" }, "x-er-surface": "v1" }, "/api/v1/auth/me": { "get": { "description": "Accepts an optional bearer token; answers 401 when none is present or it is invalid.", "operationId": "getMe", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } }, "description": "The authenticated user." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" } }, "summary": "The user behind the current token", "tags": [ "Authentication" ], "x-er-auth": "Bearer token" }, "x-er-surface": "v1" }, "/api/v1/capabilities": { "get": { "operationId": "listCapabilities", "parameters": [ { "$ref": "#/components/parameters/CapabilityProvider" }, { "$ref": "#/components/parameters/CapabilityQuery" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CapabilityList" } } }, "description": "Capabilities." }, "401": { "$ref": "#/components/responses/Unauthorized" } }, "summary": "List capabilities", "tags": [ "Catalog" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/dashboard": { "get": { "operationId": "getDashboard", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Dashboard" } } }, "description": "Aggregates over the last 24 hours plus catalog and fleet counts." }, "401": { "$ref": "#/components/responses/Unauthorized" } }, "summary": "Summary cards", "tags": [ "Dashboard" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/fleet": { "get": { "operationId": "listFleet", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetList" } } }, "description": "Runtimes, most recently seen first." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List known runtimes", "tags": [ "Fleet" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/fleet/heartbeat": { "post": { "operationId": "fleetHeartbeat", "requestBody": { "$ref": "#/components/requestBodies/Heartbeat" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StatusOK" } } }, "description": "Recorded." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Report runtime presence", "tags": [ "Fleet" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/health": { "get": { "operationId": "getV1Health", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } }, "description": "The service is up." } }, "security": [], "summary": "Health (enterprise surface)", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "v1" }, "/api/v1/organizations": { "get": { "operationId": "listOrganizations", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrganizationList" } } }, "description": "Organisations." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List organisations", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/policies": { "get": { "operationId": "listPolicies", "parameters": [ { "$ref": "#/components/parameters/PolicyActive" }, { "$ref": "#/components/parameters/RuntimeClient" } ], "responses": { "200": { "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/PolicyList" }, { "$ref": "#/components/schemas/Policy" } ] } } }, "description": "A policy list, or a single active policy." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List policies, or fetch the active one", "tags": [ "Policy" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "post": { "operationId": "publishPolicy", "requestBody": { "$ref": "#/components/requestBodies/PolicyPublish" }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Policy" } } }, "description": "The published policy, now active." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Publish a new policy version", "tags": [ "Policy" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/policies/{version}": { "get": { "operationId": "getPolicyVersion", "parameters": [ { "$ref": "#/components/parameters/PolicyVersion" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Policy" } } }, "description": "The requested version." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" } }, "summary": "Fetch one policy version", "tags": [ "Policy" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/provider-names": { "get": { "operationId": "listProviderNames", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderNames" } } }, "description": "Sorted provider names." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Provider names for filter dropdowns", "tags": [ "Catalog" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/providers": { "get": { "operationId": "listProviders", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderList" } } }, "description": "Providers." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List providers with live status", "tags": [ "Catalog" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/runtime/heartbeat": { "post": { "operationId": "runtimeHeartbeat", "requestBody": { "$ref": "#/components/requestBodies/Heartbeat" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StatusOK" } } }, "description": "Recorded." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Report runtime presence (alias)", "tags": [ "Fleet" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/runtime/register": { "post": { "operationId": "runtimeRegister", "requestBody": { "$ref": "#/components/requestBodies/RuntimeRegister" }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterResult" } } }, "description": "An existing runtime was updated." }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterResult" } } }, "description": "A new runtime was registered." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "Register a runtime", "tags": [ "Fleet" ], "x-er-auth": "JWT or X-API-Key when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/settings": { "get": { "operationId": "getSettings", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Settings" } } }, "description": "Settings." }, "401": { "$ref": "#/components/responses/Unauthorized" } }, "summary": "Organisation settings and edition flags", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/api/v1/users": { "get": { "operationId": "listUsers", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserList" } } }, "description": "Users." }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/ServerError" } }, "summary": "List users in the caller's organisation", "tags": [ "Management" ], "x-er-auth": "JWT when REQUIRE_AUTH=true" }, "x-er-surface": "v1" }, "/health": { "get": { "description": "Unprefixed health endpoint — what uptime monitors should poll.", "operationId": "getHealth", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } }, "description": "The service is up." } }, "security": [], "summary": "Liveness check", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata": { "get": { "description": "Surfaces, contract links, catalog state, and version. Browsers are shown the reference page instead.", "operationId": "getMetadata", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Metadata" } } }, "description": "Metadata index." } }, "security": [], "summary": "Service metadata index", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/apis": { "get": { "description": "Derived from this contract, so it cannot describe a route the contract omits.", "operationId": "getMetadataAPIs", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MetadataAPIs" } } }, "description": "Operation index." } }, "security": [], "summary": "Every documented operation, flattened", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/authentication": { "get": { "description": "Reports live process configuration, not intent. A deployment running\nwith `REQUIRE_AUTH=false` says so here rather than advertising\ncredentials it does not check.\n", "operationId": "getMetadataAuthentication", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MetadataAuthentication" } } }, "description": "Authentication model as configured." } }, "security": [], "summary": "What this deployment enforces right now", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/capabilities": { "get": { "description": "Capabilities the runtime can execute. `provider` and `q` filter exactly\nas they do on `{prefix}/capabilities` — two endpoints filtering the same\ndata differently would be a trap.\n", "operationId": "getMetadataCapabilities", "parameters": [ { "$ref": "#/components/parameters/CapabilityProvider" }, { "$ref": "#/components/parameters/CapabilityQuery" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CatalogCapabilities" } } }, "description": "Capability inventory with the contract envelope." } }, "security": [], "summary": "Capability inventory (contract view — no auth, no tenant)", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/catalog": { "get": { "description": "Contract version, the runtime commit the catalog was built from,\ngeneration time and counts — without the payload. The cheapest way to\ncheck whether a cached contract is current.\n\n`runtime.commit` is what makes this auditable: `generated_at` says when\nthe catalog was built, not what from. When a catalog is generated\nwithout a runtime checkout, `runtime.known` is false and the commit is\nabsent rather than guessed.\n", "operationId": "getMetadataCatalog", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CatalogContract" } } }, "description": "Envelope plus links to the inventories." } }, "security": [], "summary": "Provider/capability contract envelope", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/providers": { "get": { "description": "What the runtime supports, read straight from the embedded catalog.\n\nDistinct from `{prefix}/providers`, which is the **tenant** view: that\none merges live status, `last_used` and org scope from the database and\nneeds an organisation. This one needs no credentials, touches no\ndatabase, and gives every caller the same answer.\n", "operationId": "getMetadataProviders", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CatalogProviders" } } }, "description": "Provider inventory with the contract envelope." } }, "security": [], "summary": "Provider inventory (contract view — no auth, no tenant)", "tags": [ "Catalog" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/metadata/versions": { "get": { "operationId": "getMetadataVersions", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MetadataVersions" } } }, "description": "Version metadata." } }, "security": [], "summary": "Build, contract, and surface versions", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/openapi.json": { "get": { "operationId": "getOpenAPIJSON", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "The same document, parsed to JSON. Drives the explorer at /swagger." } }, "security": [], "summary": "This contract as JSON, with the requesting host in `servers`", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/openapi.yaml": { "get": { "operationId": "getOpenAPIYAML", "responses": { "200": { "content": { "application/yaml": { "schema": { "type": "string" } } }, "description": "The OpenAPI document, byte for byte as this repository holds it." } }, "security": [], "summary": "This contract, canonical YAML", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" }, "/version": { "get": { "operationId": "getVersion", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VersionInfo" } } }, "description": "Build metadata." } }, "security": [], "summary": "Build and uptime of the running instance", "tags": [ "Service" ], "x-er-auth": "none" }, "x-er-surface": "portal" } }, "security": [ { "bearerAuth": [] }, { "apiKeyAuth": [] } ], "servers": [ { "description": "This host", "url": "https://api.engineeringruntime.com" }, { "description": "Local development", "url": "http://localhost:8081" } ], "tags": [ { "description": "Versioned policy documents. Runtimes fetch the active one and evaluate locally.", "name": "Policy" }, { "description": "Command decisions reported by runtimes. The runtime's local record is the system of record.", "name": "Audit" }, { "description": "Providers and capabilities, generated from the runtime repository at\ndeploy time. Two views: the **contract** view on /metadata/* (no auth, no\ntenant, carries runtime provenance) and the **tenant** view on\n{prefix}/providers and {prefix}/capabilities (org-scoped, adds live status\nfrom the database).\n", "name": "Catalog" }, { "description": "Runtime presence. Status is derived from last contact, never scheduled.", "name": "Fleet" }, { "description": "Aggregates for the UIs.", "name": "Dashboard" }, { "description": "Login and identity. `/api/v1` only.", "name": "Authentication" }, { "description": "Organisations, users, API keys, settings. `/api/v1` only.", "name": "Management" }, { "description": "Health, version, and machine-readable metadata about this API.", "name": "Service" } ] }