{
  "components": {
    "schemas": {
      "ACLCheck": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "missing": {
            "description": "Generated rules absent from the stored policy",
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "readable": {
            "type": "boolean"
          },
          "stale": {
            "description": "Rules NebulaCtrl owns in the stored policy that are no longer generated",
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "readable",
          "message",
          "missing",
          "stale"
        ],
        "type": "object"
      },
      "ACLDiff": {
        "additionalProperties": false,
        "properties": {
          "add": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "remove": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "add",
          "remove"
        ],
        "type": "object"
      },
      "ACLPreview": {
        "additionalProperties": false,
        "properties": {
          "diff": {
            "$ref": "#/components/schemas/ACLDiff",
            "description": "Against the policy currently stored in the tailnet, when it could be read"
          },
          "policy": {
            "description": "What NebulaCtrl owns (managed Headscale: the whole policy) or the snippet to paste (HuJSON with comments)",
            "type": "string"
          },
          "rules": {
            "items": {
              "$ref": "#/components/schemas/RuleView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "rules",
          "policy"
        ],
        "type": "object"
      },
      "AcceptInputBody": {
        "additionalProperties": false,
        "properties": {
          "fingerprint": {
            "description": "The SHA256 fingerprint of the host key you reviewed; the key is pinned only if the server still presents it",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "fingerprint"
        ],
        "type": "object"
      },
      "AcceptInviteInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "description": "Sign-up only",
            "maxLength": 254,
            "type": "string"
          },
          "name": {
            "description": "Sign-up only",
            "maxLength": 100,
            "type": "string"
          },
          "password": {
            "description": "Sign-up only: creates the account",
            "maxLength": 256,
            "type": "string"
          }
        },
        "type": "object"
      },
      "AcceptedInvite": {
        "additionalProperties": false,
        "properties": {
          "createdAccount": {
            "description": "A new account was created through the invite and signed in",
            "type": "boolean"
          },
          "team": {
            "$ref": "#/components/schemas/Team"
          }
        },
        "required": [
          "team",
          "createdAccount"
        ],
        "type": "object"
      },
      "AcceptedOutputBody": {
        "additionalProperties": false,
        "properties": {
          "accepted": {
            "type": "boolean"
          }
        },
        "required": [
          "accepted"
        ],
        "type": "object"
      },
      "Access": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "denyCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rejectStatus": {
            "format": "int64",
            "type": "integer"
          },
          "trustedProxyDepth": {
            "format": "int64",
            "type": "integer"
          }
        },
        "type": "object"
      },
      "AccountRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name"
        ],
        "type": "object"
      },
      "ActionResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          }
        },
        "required": [
          "commandId"
        ],
        "type": "object"
      },
      "AddReplicaInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptMeshChanges": {
            "description": "Confirms that the replica adds tailnet devices (a replication link)",
            "type": "boolean"
          },
          "dryRun": {
            "description": "Only return the plan",
            "type": "boolean"
          },
          "name": {
            "description": "Display name; defaults to \u003cprimary\u003e-replica-\u003cn\u003e",
            "maxLength": 100,
            "type": "string"
          },
          "serverId": {
            "description": "The server the replica runs on (the primary's server, or another server with the mesh enabled)",
            "type": "string"
          }
        },
        "required": [
          "serverId"
        ],
        "type": "object"
      },
      "AddReplicaResult": {
        "additionalProperties": false,
        "properties": {
          "dryRun": {
            "type": "boolean"
          },
          "plan": {
            "$ref": "#/components/schemas/ReplicaPlan"
          },
          "serviceId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "dryRun",
          "plan"
        ],
        "type": "object"
      },
      "AddUserInputBody": {
        "additionalProperties": false,
        "properties": {
          "displayName": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "email": {
            "maxLength": 254,
            "minLength": 3,
            "type": "string"
          },
          "password": {
            "description": "Empty generates one (returned once).",
            "maxLength": 128,
            "type": "string"
          },
          "username": {
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "username",
          "displayName",
          "email"
        ],
        "type": "object"
      },
      "AdminLink": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "url": {
            "description": "Open it once to sign in to Pocket ID and register a passkey. Shown once: it is not stored.",
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "url",
          "expiresAt",
          "username",
          "email"
        ],
        "type": "object"
      },
      "AdminProvidersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ProviderBody"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ApplyInputBody": {
        "additionalProperties": false,
        "properties": {
          "acknowledgeProduction": {
            "description": "Required when production services or the control plane run on the server",
            "type": "boolean"
          },
          "confirm": {
            "description": "The server's name, typed by the person",
            "type": "string"
          },
          "securityOnly": {
            "description": "Upgrade only the packages with a security update",
            "type": "boolean"
          }
        },
        "required": [
          "confirm"
        ],
        "type": "object"
      },
      "ApprovalPlan": {
        "additionalProperties": false,
        "properties": {
          "effects": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "environment": {
            "type": "string"
          },
          "irreversible": {
            "type": "boolean"
          },
          "op": {
            "type": "string"
          },
          "project": {
            "type": "string"
          },
          "summary": {
            "type": "string"
          },
          "targets": {
            "items": {
              "$ref": "#/components/schemas/ApprovalTarget"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "op",
          "summary",
          "project",
          "environment",
          "targets"
        ],
        "type": "object"
      },
      "ApprovalRequester": {
        "additionalProperties": false,
        "properties": {
          "clientName": {
            "description": "MCP clientInfo name, when the client sent one",
            "type": "string"
          },
          "kind": {
            "description": "mcp for an MCP client, token for a REST API token",
            "enum": [
              "mcp",
              "token"
            ],
            "type": "string"
          },
          "tokenName": {
            "type": "string"
          }
        },
        "required": [
          "kind",
          "tokenName"
        ],
        "type": "object"
      },
      "ApprovalTarget": {
        "additionalProperties": false,
        "properties": {
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "description": "service, environment, project, backup, volume or domain",
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "kind",
          "id",
          "name"
        ],
        "type": "object"
      },
      "ApprovalView": {
        "additionalProperties": false,
        "properties": {
          "canDecide": {
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "decidedAt": {
            "format": "date-time",
            "type": "string"
          },
          "decidedBy": {
            "description": "Name of the person who decided",
            "type": "string"
          },
          "decidedVia": {
            "enum": [
              "web",
              "elicitation"
            ],
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "plan": {
            "$ref": "#/components/schemas/ApprovalPlan"
          },
          "projectId": {
            "type": "string"
          },
          "requester": {
            "$ref": "#/components/schemas/ApprovalRequester"
          },
          "status": {
            "enum": [
              "pending",
              "approved",
              "declined",
              "used",
              "expired",
              "stale"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "plan",
          "projectId",
          "environmentId",
          "requester",
          "createdAt",
          "expiresAt",
          "canDecide"
        ],
        "type": "object"
      },
      "AttachedService": {
        "additionalProperties": false,
        "properties": {
          "alias": {
            "type": "string"
          },
          "envName": {
            "type": "string"
          },
          "envSlug": {
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "projectName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "name",
          "slug",
          "kind",
          "projectId",
          "projectName",
          "environmentId",
          "envName",
          "envSlug",
          "alias"
        ],
        "type": "object"
      },
      "AuditEvent": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "type": "string"
          },
          "actorId": {
            "type": "string"
          },
          "actorLabel": {
            "type": "string"
          },
          "actorType": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "metadata": {
            "additionalProperties": {},
            "type": "object"
          },
          "projectId": {
            "type": "string"
          },
          "resourceId": {
            "type": "string"
          },
          "resourceType": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "actorType",
          "actorId",
          "actorLabel",
          "action",
          "resourceType",
          "resourceId",
          "metadata",
          "createdAt"
        ],
        "type": "object"
      },
      "AuditInputBody": {
        "additionalProperties": false,
        "properties": {
          "installLynis": {
            "description": "Install Lynis from the distribution's or CISOfy's package repository when the server does not have it",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "AuthSettingsBody": {
        "additionalProperties": false,
        "properties": {
          "allowOpenSignup": {
            "description": "Let anyone create an account through an identity provider without an invite (default off)",
            "type": "boolean"
          }
        },
        "required": [
          "allowOpenSignup"
        ],
        "type": "object"
      },
      "AuthUserBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "description": "Omit to keep the password of an existing user",
            "maxLength": 72,
            "type": "string"
          },
          "username": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "username"
        ],
        "type": "object"
      },
      "AuthUsersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "usernames": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "usernames"
        ],
        "type": "object"
      },
      "AuthorizeOutputBody": {
        "additionalProperties": false,
        "properties": {
          "authorizeUrl": {
            "type": "string"
          }
        },
        "required": [
          "authorizeUrl"
        ],
        "type": "object"
      },
      "Autoscaling": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "max": {
            "format": "int64",
            "type": "integer"
          },
          "min": {
            "format": "int64",
            "type": "integer"
          },
          "targetCpuPercent": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "min",
          "max",
          "targetCpuPercent"
        ],
        "type": "object"
      },
      "AutoscalingPatch": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "max": {
            "description": "Highest replica count, 1-10; at least min",
            "format": "int64",
            "type": "integer"
          },
          "min": {
            "description": "Lowest replica count, 1-10",
            "format": "int64",
            "type": "integer"
          },
          "targetCpuPercent": {
            "description": "Per-replica CPU target as a percentage of the replica's CPU limit (one core without a limit), 20-95",
            "format": "int64",
            "type": "integer"
          }
        },
        "type": "object"
      },
      "BackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "destinationId": {
            "type": "string"
          }
        },
        "required": [
          "destinationId"
        ],
        "type": "object"
      },
      "BackupListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/BackupView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BackupView": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "database": {
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "destinationKind": {
            "type": "string"
          },
          "destinationName": {
            "type": "string"
          },
          "engine": {
            "type": "string"
          },
          "engineVersion": {
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "format": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "locked": {
            "type": "boolean"
          },
          "objectDeleted": {
            "description": "True once retention or a user removed the stored object; the row stays as history.",
            "type": "boolean"
          },
          "objectKey": {
            "type": "string"
          },
          "restorable": {
            "type": "boolean"
          },
          "scheduleId": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "sha256": {
            "type": "string"
          },
          "sizeBytes": {
            "format": "int64",
            "type": "integer"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "queued",
              "running",
              "succeeded",
              "failed",
              "skipped",
              "expired"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "manual",
              "schedule",
              "pre_restore"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "serviceId",
          "destinationId",
          "trigger",
          "status",
          "engine",
          "sizeBytes",
          "locked",
          "objectDeleted",
          "restorable",
          "createdAt"
        ],
        "type": "object"
      },
      "Blocker": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "BranchesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "BuildInfo": {
        "additionalProperties": false,
        "properties": {
          "builder": {
            "type": "string"
          },
          "dockerfile": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "packages": {
            "items": {
              "$ref": "#/components/schemas/BuildPackage"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "providers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "railpackVersion": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "startCommand": {
            "type": "string"
          },
          "starter": {
            "type": "string"
          },
          "steps": {
            "items": {
              "$ref": "#/components/schemas/BuildStep"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "method"
        ],
        "type": "object"
      },
      "BuildPackage": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "version"
        ],
        "type": "object"
      },
      "BuildPlanResult": {
        "additionalProperties": false,
        "properties": {
          "commitSha": {
            "type": "string"
          },
          "dockerfileFound": {
            "type": "boolean"
          },
          "dockerfilePath": {
            "type": "string"
          },
          "info": {
            "$ref": "#/components/schemas/BuildInfo"
          },
          "message": {
            "type": "string"
          },
          "messages": {
            "items": {
              "$ref": "#/components/schemas/PlanLog"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "outcome": {
            "type": "string"
          },
          "requested": {
            "type": "string"
          },
          "suggestedStarter": {
            "type": "string"
          }
        },
        "required": [
          "outcome",
          "requested",
          "dockerfilePath",
          "dockerfileFound"
        ],
        "type": "object"
      },
      "BuildStep": {
        "additionalProperties": false,
        "properties": {
          "commands": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CORS": {
        "additionalProperties": false,
        "properties": {
          "credentials": {
            "type": "boolean"
          },
          "exposeHeaders": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "headers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "maxAgeSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "methods": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "origins": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "origins"
        ],
        "type": "object"
      },
      "Canvas": {
        "additionalProperties": false,
        "properties": {
          "layout": {
            "$ref": "#/components/schemas/Layout"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "layout",
          "version"
        ],
        "type": "object"
      },
      "Capacity": {
        "additionalProperties": false,
        "properties": {
          "reasons": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "targetFits": {
            "type": "boolean"
          }
        },
        "required": [
          "targetFits",
          "reasons"
        ],
        "type": "object"
      },
      "CatalogOutputBody": {
        "additionalProperties": false,
        "properties": {
          "engines": {
            "items": {
              "$ref": "#/components/schemas/EngineView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "engines"
        ],
        "type": "object"
      },
      "CatalogTemplate": {
        "additionalProperties": false,
        "properties": {
          "category": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "group": {
            "type": "string"
          },
          "heavy": {
            "type": "boolean"
          },
          "icon": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "inputs": {
            "items": {
              "$ref": "#/components/schemas/TemplateInput"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "links": {
            "$ref": "#/components/schemas/TemplateLinks"
          },
          "name": {
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "origin": {
            "$ref": "#/components/schemas/TemplateOrigin"
          },
          "requires": {
            "$ref": "#/components/schemas/TemplateRequires"
          },
          "requiresUnrestricted": {
            "type": "boolean"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "schema": {
            "format": "int64",
            "type": "integer"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/TemplateService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "summary": {
            "type": "string"
          },
          "tags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "upstream": {
            "$ref": "#/components/schemas/TemplateUpstream"
          }
        },
        "required": [
          "schema",
          "id",
          "revision",
          "name",
          "summary",
          "category",
          "tags",
          "links",
          "upstream",
          "requires",
          "inputs",
          "services",
          "notes"
        ],
        "type": "object"
      },
      "CertificatesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ServerCertificate"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ChangePasswordInputBody": {
        "additionalProperties": false,
        "properties": {
          "currentPassword": {
            "maxLength": 256,
            "type": "string"
          },
          "newPassword": {
            "maxLength": 256,
            "minLength": 10,
            "type": "string"
          }
        },
        "required": [
          "currentPassword",
          "newPassword"
        ],
        "type": "object"
      },
      "ChangesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/FieldChange"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ChannelConfig": {
        "additionalProperties": false,
        "properties": {
          "chatId": {
            "description": "Telegram: chat id (-100123...) or @channelname the bot posts to.",
            "type": "string"
          },
          "from": {
            "description": "Email: sender, \"alerts@example.com\" or \"NebulaCtrl \u003calerts@example.com\u003e\".",
            "type": "string"
          },
          "host": {
            "description": "Email: SMTP server host name.",
            "type": "string"
          },
          "insecureSkipVerify": {
            "description": "Email: accept any server certificate (self-signed relays). The connection is still encrypted.",
            "type": "boolean"
          },
          "port": {
            "description": "Email: SMTP port. Default: 465 (implicit TLS), 587 (STARTTLS), 25 (none).",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "tls": {
            "description": "Email: connection security. Default starttls.",
            "enum": [
              "implicit",
              "starttls",
              "none"
            ],
            "type": "string"
          },
          "to": {
            "description": "Email: recipients.",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "username": {
            "description": "Email: SMTP user name; empty sends without authentication.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "ChannelDelivery": {
        "additionalProperties": false,
        "properties": {
          "attempts": {
            "format": "int64",
            "type": "integer"
          },
          "body": {
            "type": "string"
          },
          "channelId": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "deliveredAt": {
            "format": "date-time",
            "type": "string"
          },
          "eventType": {
            "type": "string"
          },
          "fields": {
            "items": {
              "$ref": "#/components/schemas/MessageField"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "isTest": {
            "type": "boolean"
          },
          "lastError": {
            "description": "Why the last attempt failed; credentials are masked.",
            "type": "string"
          },
          "maxAttempts": {
            "format": "int64",
            "type": "integer"
          },
          "nextAttemptAt": {
            "format": "date-time",
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "responseCode": {
            "description": "HTTP status or SMTP reply code of the last attempt.",
            "format": "int64",
            "type": "integer"
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "error"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "retrying",
              "delivered",
              "failed"
            ],
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "channelId",
          "eventType",
          "severity",
          "title",
          "status",
          "attempts",
          "maxAttempts",
          "lastError",
          "isTest",
          "createdAt"
        ],
        "type": "object"
      },
      "ChannelDeliveryPage": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ChannelDelivery"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when older deliveries exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ChannelEventType": {
        "additionalProperties": false,
        "properties": {
          "defaultOn": {
            "type": "boolean"
          },
          "description": {
            "type": "string"
          },
          "group": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "error"
            ],
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type",
          "label",
          "description",
          "group",
          "severity",
          "defaultOn"
        ],
        "type": "object"
      },
      "ChannelListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ChannelView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ChannelRule": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "description": "true: the whole workspace, including events that belong to no project (server alerts). false: only events of projectIds.",
            "type": "boolean"
          },
          "eventTypes": {
            "description": "Subscribed event types (see GET /notifications/event-types).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "minSeverity": {
            "description": "Events below this severity are not sent.",
            "enum": [
              "info",
              "warning",
              "error"
            ],
            "type": "string"
          },
          "projectIds": {
            "description": "Projects of a project-scoped rule.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "eventTypes",
          "minSeverity",
          "allProjects",
          "projectIds"
        ],
        "type": "object"
      },
      "ChannelRuleInput": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "description": "Default true: the whole workspace. false: only projectIds.",
            "type": "boolean"
          },
          "eventTypes": {
            "description": "Subscribed event types (see GET /notifications/event-types).",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "minSeverity": {
            "description": "Events below this severity are not sent. Default info.",
            "enum": [
              "info",
              "warning",
              "error"
            ],
            "type": "string"
          },
          "projectIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "eventTypes"
        ],
        "type": "object"
      },
      "ChannelSecretsInput": {
        "additionalProperties": false,
        "properties": {
          "botToken": {
            "description": "Telegram: the bot token from @BotFather.",
            "type": "string"
          },
          "password": {
            "description": "Email: the SMTP password.",
            "type": "string"
          },
          "signingSecret": {
            "description": "Webhook: the HMAC signing secret. Omit on create to have one generated.",
            "type": "string"
          },
          "url": {
            "description": "Slack, Discord and webhook: the endpoint URL (it is the credential for Slack and Discord).",
            "type": "string"
          }
        },
        "type": "object"
      },
      "ChannelStats": {
        "additionalProperties": false,
        "properties": {
          "delivered24h": {
            "format": "int64",
            "type": "integer"
          },
          "failed24h": {
            "format": "int64",
            "type": "integer"
          },
          "lastDeliveryAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "delivered24h",
          "failed24h"
        ],
        "type": "object"
      },
      "ChannelTestState": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          }
        },
        "required": [
          "message"
        ],
        "type": "object"
      },
      "ChannelView": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "email",
              "slack",
              "discord",
              "telegram",
              "webhook"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "rule": {
            "$ref": "#/components/schemas/ChannelRule"
          },
          "secrets": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Masked hints of the stored secrets, keyed by name (url, botToken, password, signingSecret). A key is present when the secret is set; its value never reveals it.",
            "type": "object"
          },
          "stats": {
            "$ref": "#/components/schemas/ChannelStats"
          },
          "test": {
            "$ref": "#/components/schemas/ChannelTestState"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "enabled",
          "config",
          "secrets",
          "rule",
          "test",
          "stats",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "CheckServerInputBody": {
        "additionalProperties": false,
        "properties": {
          "peerServerId": {
            "description": "Check only this peer (default: every other server with a mesh node)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "CheckServerOutputBody": {
        "additionalProperties": false,
        "properties": {
          "results": {
            "items": {
              "$ref": "#/components/schemas/ServerCheckResult"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "results"
        ],
        "type": "object"
      },
      "CheckStackInputBody": {
        "additionalProperties": false,
        "properties": {
          "compose": {
            "description": "The compose file (YAML) to check",
            "maxLength": 262144,
            "minLength": 1,
            "type": "string"
          },
          "serverId": {
            "description": "The server the stack will run on; decides whether Unrestricted applies",
            "type": "string"
          }
        },
        "required": [
          "compose"
        ],
        "type": "object"
      },
      "CleanupRun": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "items": {
            "description": "Things removed: containers, images, networks or volumes",
            "format": "int64",
            "type": "integer"
          },
          "mode": {
            "description": "standard is the scheduled cleanup; volumes the explicit removal of unused volumes",
            "enum": [
              "standard",
              "volumes"
            ],
            "type": "string"
          },
          "reclaimedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "enum": [
              "pending",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "steps": {
            "description": "What each prune step did; empty until the agent reports",
            "items": {
              "$ref": "#/components/schemas/CleanupStep"
            },
            "type": "array"
          },
          "trigger": {
            "enum": [
              "scheduled",
              "emergency",
              "manual"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "mode",
          "trigger",
          "status",
          "reclaimedBytes",
          "items",
          "createdAt",
          "finishedAt",
          "steps"
        ],
        "type": "object"
      },
      "CleanupStep": {
        "additionalProperties": false,
        "properties": {
          "error": {
            "type": "string"
          },
          "items": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "enum": [
              "containers_unmanaged",
              "images_dangling",
              "images_unused",
              "build_cache",
              "networks",
              "volumes"
            ],
            "type": "string"
          },
          "protected": {
            "description": "Images kept because a release or the infrastructure needs them",
            "format": "int64",
            "type": "integer"
          },
          "reclaimedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "removed": {
            "description": "Names of removed things (the first few)",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "skipped": {
            "description": "Why the step did not run",
            "type": "string"
          }
        },
        "required": [
          "name",
          "items",
          "reclaimedBytes",
          "protected",
          "removed"
        ],
        "type": "object"
      },
      "CleanupView": {
        "additionalProperties": false,
        "properties": {
          "agentSupported": {
            "description": "The server's agent can run a cleanup",
            "type": "boolean"
          },
          "buildCacheMinAgeDays": {
            "description": "Build cache older than this many days is pruned (default 7)",
            "format": "int64",
            "type": "integer"
          },
          "cron": {
            "description": "The schedule as a 5-field cron expression, evaluated in UTC (default 0 4 * * *)",
            "type": "string"
          },
          "diskAlert": {
            "description": "The disk alert is active now",
            "type": "boolean"
          },
          "diskAlertThresholdPercent": {
            "description": "The server's disk alert threshold, which starts the emergency cleanup when diskTriggerPercent is null",
            "format": "int64",
            "type": "integer"
          },
          "diskTriggerPercent": {
            "description": "Disk usage (50-99) that starts an emergency cleanup; null follows the server's disk alert threshold",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "enabled": {
            "description": "Scheduled and emergency cleanups run (default true)",
            "type": "boolean"
          },
          "nextRunAt": {
            "description": "The next scheduled cleanup; null when cleanup is off",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "removeStoppedUnmanaged": {
            "description": "Also remove stopped containers NebulaCtrl does not manage (default false)",
            "type": "boolean"
          },
          "running": {
            "description": "A cleanup is waiting for the agent or running",
            "type": "boolean"
          },
          "runs": {
            "description": "The most recent runs, newest first",
            "items": {
              "$ref": "#/components/schemas/CleanupRun"
            },
            "type": "array"
          },
          "schedule": {
            "description": "The schedule in words",
            "type": "string"
          },
          "unusedImageMinAgeHours": {
            "description": "Unused images older than this are removed unless a release or the infrastructure needs them (default 72)",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "removeStoppedUnmanaged",
          "cron",
          "schedule",
          "unusedImageMinAgeHours",
          "buildCacheMinAgeDays",
          "diskTriggerPercent",
          "diskAlertThresholdPercent",
          "diskAlert",
          "agentSupported",
          "running",
          "nextRunAt",
          "runs"
        ],
        "type": "object"
      },
      "CloneDomainOutcome": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "dropped",
              "suffixed",
              "generated",
              "conflict",
              "skipped"
            ],
            "type": "string"
          },
          "hostname": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "service": {
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "service",
          "hostname",
          "action"
        ],
        "type": "object"
      },
      "CloneEnvironmentInputBody": {
        "additionalProperties": false,
        "properties": {
          "domainSuffix": {
            "description": "Default: -\u003cnew environment slug\u003e",
            "maxLength": 40,
            "type": "string"
          },
          "domains": {
            "description": "drop (default) clones no domain; suffix clones each public domain with domainSuffix added to its first label",
            "enum": [
              "drop",
              "suffix"
            ],
            "type": "string"
          },
          "dryRun": {
            "description": "Report what the clone would do and change nothing",
            "type": "boolean"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "serverId": {
            "description": "Place every cloned service on this server (default: each service keeps its server)",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CloneEnvironmentRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "isProduction": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "projectId",
          "name",
          "slug",
          "isProduction"
        ],
        "type": "object"
      },
      "CloneResult": {
        "additionalProperties": false,
        "properties": {
          "domains": {
            "items": {
              "$ref": "#/components/schemas/CloneDomainOutcome"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "dryRun": {
            "type": "boolean"
          },
          "environment": {
            "$ref": "#/components/schemas/CloneEnvironmentRef"
          },
          "links": {
            "format": "int64",
            "type": "integer"
          },
          "references": {
            "items": {
              "$ref": "#/components/schemas/ReferenceFinding"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "service": {
            "$ref": "#/components/schemas/ServiceView"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/ClonedService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sharedVariables": {
            "format": "int64",
            "type": "integer"
          },
          "skipped": {
            "items": {
              "$ref": "#/components/schemas/CloneSkipped"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "dryRun",
          "services",
          "skipped",
          "domains",
          "references",
          "links",
          "sharedVariables",
          "warnings"
        ],
        "type": "object"
      },
      "CloneServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "domainSuffix": {
            "description": "Default: -copy in the same environment, -\u003cenvironment slug\u003e in another one",
            "maxLength": 40,
            "type": "string"
          },
          "domains": {
            "description": "drop (default) clones no domain; suffix clones each public domain with domainSuffix added to its first label",
            "enum": [
              "drop",
              "suffix"
            ],
            "type": "string"
          },
          "dryRun": {
            "description": "Report what the clone would do and change nothing",
            "type": "boolean"
          },
          "environmentId": {
            "description": "Environment of the clone (default: the source's environment)",
            "type": "string"
          },
          "name": {
            "description": "Name of the clone (default: the source's name plus ' copy' in the same environment)",
            "maxLength": 100,
            "type": "string"
          },
          "serverId": {
            "description": "Server of the clone (default: the source's server)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "CloneSkipped": {
        "additionalProperties": false,
        "properties": {
          "reason": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "slug",
          "reason"
        ],
        "type": "object"
      },
      "ClonedService": {
        "additionalProperties": false,
        "properties": {
          "fresh": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "sourceId": {
            "type": "string"
          }
        },
        "required": [
          "sourceId",
          "id",
          "name",
          "slug",
          "kind",
          "fresh"
        ],
        "type": "object"
      },
      "CloudflareConnectionView": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "description": "Account used for Cloudflare Tunnel calls",
            "type": "string"
          },
          "accountName": {
            "type": "string"
          },
          "accounts": {
            "description": "Accounts the token's zones belong to",
            "items": {
              "$ref": "#/components/schemas/AccountRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "autoManage": {
            "description": "New domains in a connected zone get their DNS records managed automatically",
            "type": "boolean"
          },
          "configured": {
            "type": "boolean"
          },
          "defaultProxied": {
            "description": "New managed records start proxied (orange cloud)",
            "type": "boolean"
          },
          "status": {
            "description": "error after Cloudflare rejected the token; empty when not configured",
            "enum": [
              "",
              "ok",
              "error"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "tokenExpiresAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "verifiedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "zoneCount": {
            "format": "int64",
            "type": "integer"
          },
          "zonesSyncedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "configured",
          "status",
          "statusMessage",
          "accountId",
          "accountName",
          "accounts",
          "autoManage",
          "defaultProxied",
          "tokenExpiresAt",
          "verifiedAt",
          "zonesSyncedAt",
          "zoneCount",
          "warnings"
        ],
        "type": "object"
      },
      "CommandView": {
        "additionalProperties": false,
        "properties": {
          "ackedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "createdAt": {
            "description": "When the control plane enqueued the command",
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "outcome": {
            "type": "string"
          },
          "payload": {},
          "result": {},
          "sentAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "kind",
          "serverId",
          "serverName",
          "status",
          "outcome",
          "error",
          "payload",
          "result",
          "createdAt",
          "sentAt",
          "ackedAt",
          "finishedAt",
          "expiresAt"
        ],
        "type": "object"
      },
      "CommandsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/CommandView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "CommitView": {
        "additionalProperties": false,
        "properties": {
          "author": {
            "type": "string"
          },
          "branch": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "sha": {
            "type": "string"
          }
        },
        "required": [
          "sha",
          "message",
          "author",
          "branch"
        ],
        "type": "object"
      },
      "ComposeCheck": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "status": {
            "enum": [
              "ok",
              "warn",
              "fail"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "message"
        ],
        "type": "object"
      },
      "ComposeChoices": {
        "additionalProperties": false,
        "properties": {
          "services": {
            "additionalProperties": {
              "$ref": "#/components/schemas/ComposeServiceChoice"
            },
            "type": "object"
          },
          "variables": {
            "additionalProperties": {
              "$ref": "#/components/schemas/ComposeEnvChoice"
            },
            "type": "object"
          }
        },
        "type": "object"
      },
      "ComposeDomainChoice": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "host": {
            "maxLength": 253,
            "type": "string"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "ComposeEnvChoice": {
        "additionalProperties": false,
        "properties": {
          "rewrite": {
            "description": "false keeps the original host names in this variable",
            "type": "boolean"
          },
          "secret": {
            "description": "Store the value as a secret (encrypted, never shown again)",
            "type": "boolean"
          },
          "skip": {
            "description": "Do not import this variable",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "ComposeImportRequest": {
        "additionalProperties": false,
        "properties": {
          "choices": {
            "$ref": "#/components/schemas/ComposeChoices"
          },
          "deploy": {
            "type": "boolean"
          },
          "mode": {
            "default": "split",
            "enum": [
              "split",
              "stack"
            ],
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ComposeSource"
          }
        },
        "required": [
          "source",
          "choices",
          "serverId"
        ],
        "type": "object"
      },
      "ComposeImportResult": {
        "additionalProperties": false,
        "properties": {
          "deployments": {
            "items": {
              "$ref": "#/components/schemas/DeploymentView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "groupId": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "rewrites": {
            "items": {
              "$ref": "#/components/schemas/ComposeRewrite"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/ServiceView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "groupId",
          "services",
          "deployments",
          "rewrites",
          "warnings"
        ],
        "type": "object"
      },
      "ComposeNeededFile": {
        "additionalProperties": false,
        "properties": {
          "path": {
            "description": "The path as written in the Compose file",
            "type": "string"
          },
          "purpose": {
            "description": "What the file is for",
            "enum": [
              "env_file",
              "bind"
            ],
            "type": "string"
          },
          "required": {
            "type": "boolean"
          },
          "service": {
            "type": "string"
          }
        },
        "required": [
          "path",
          "purpose",
          "service",
          "required"
        ],
        "type": "object"
      },
      "ComposeNote": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "description": "The Compose key, e.g. privileged or volumes[0]",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "danger"
            ],
            "type": "string"
          }
        },
        "required": [
          "key",
          "severity",
          "message"
        ],
        "type": "object"
      },
      "ComposePlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "checks": {
            "items": {
              "$ref": "#/components/schemas/ComposeCheck"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "commit": {
            "type": "string"
          },
          "installable": {
            "type": "boolean"
          },
          "missing": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "mode": {
            "enum": [
              "split",
              "stack"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "neededFiles": {
            "items": {
              "$ref": "#/components/schemas/ComposeNeededFile"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "networks": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanNetwork"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "notes": {
            "description": "Project-level remarks",
            "items": {
              "$ref": "#/components/schemas/ComposeNote"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rewrites": {
            "items": {
              "$ref": "#/components/schemas/ComposeRewrite"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sourceKind": {
            "enum": [
              "paste",
              "repo"
            ],
            "type": "string"
          },
          "stack": {
            "$ref": "#/components/schemas/ComposeStackPlan"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "services",
          "networks",
          "rewrites",
          "missing",
          "neededFiles",
          "notes",
          "warnings",
          "checks",
          "blockers",
          "installable",
          "mode",
          "sourceKind"
        ],
        "type": "object"
      },
      "ComposePlanBind": {
        "additionalProperties": false,
        "properties": {
          "canConvert": {
            "type": "boolean"
          },
          "reason": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "status": {
            "enum": [
              "file",
              "missing",
              "rejected",
              "ignored",
              "converted"
            ],
            "type": "string"
          },
          "target": {
            "type": "string"
          }
        },
        "required": [
          "source",
          "target",
          "status",
          "canConvert"
        ],
        "type": "object"
      },
      "ComposePlanBuild": {
        "additionalProperties": false,
        "properties": {
          "argNames": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "buildContext": {
            "type": "string"
          },
          "connectionId": {
            "type": "string"
          },
          "context": {
            "type": "string"
          },
          "dockerfile": {
            "type": "string"
          },
          "dockerfilePath": {
            "type": "string"
          },
          "gitBranch": {
            "type": "string"
          },
          "gitUrl": {
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "target": {
            "type": "string"
          }
        },
        "required": [
          "context",
          "argNames"
        ],
        "type": "object"
      },
      "ComposePlanDomain": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "generate": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "source": {
            "enum": [
              "traefik",
              "suggested",
              "choice"
            ],
            "type": "string"
          }
        },
        "required": [
          "generate",
          "enabled",
          "source"
        ],
        "type": "object"
      },
      "ComposePlanEnv": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "note": {
            "type": "string"
          },
          "origin": {
            "enum": [
              "environment",
              "env_file",
              "dotenv"
            ],
            "type": "string"
          },
          "rewritten": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          },
          "secretGuess": {
            "type": "boolean"
          },
          "skipped": {
            "type": "boolean"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "value",
          "secret",
          "secretGuess",
          "origin",
          "rewritten",
          "skipped"
        ],
        "type": "object"
      },
      "ComposePlanFile": {
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "format": "int64",
            "type": "integer"
          },
          "mode": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "source": {
            "description": "The path as written in the Compose file",
            "type": "string"
          }
        },
        "required": [
          "path",
          "bytes",
          "source"
        ],
        "type": "object"
      },
      "ComposePlanHealth": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deadlineSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "fromCompose": {
            "type": "boolean"
          },
          "intervalSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "startPeriodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "successThreshold": {
            "format": "int64",
            "type": "integer"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type",
          "fromCompose"
        ],
        "type": "object"
      },
      "ComposePlanManaged": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "type": "string"
          },
          "eligible": {
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "engine": {
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "reason": {
            "type": "string"
          },
          "username": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "eligible",
          "enabled",
          "notes"
        ],
        "type": "object"
      },
      "ComposePlanNetwork": {
        "additionalProperties": false,
        "properties": {
          "external": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "note": {
            "type": "string"
          },
          "services": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sharedNetworkId": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "external",
          "services",
          "note"
        ],
        "type": "object"
      },
      "ComposePlanPort": {
        "additionalProperties": false,
        "properties": {
          "hostPort": {
            "description": "Port published on the host in the Compose file",
            "format": "int64",
            "type": "integer"
          },
          "listen": {
            "format": "int64",
            "type": "integer"
          },
          "port": {
            "description": "Container port",
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "enum": [
              "tcp",
              "udp"
            ],
            "type": "string"
          },
          "publish": {
            "type": "boolean"
          },
          "role": {
            "enum": [
              "http",
              "tcp",
              "udp"
            ],
            "type": "string"
          }
        },
        "required": [
          "port",
          "protocol",
          "role",
          "publish"
        ],
        "type": "object"
      },
      "ComposePlanRequest": {
        "additionalProperties": false,
        "properties": {
          "choices": {
            "$ref": "#/components/schemas/ComposeChoices"
          },
          "mode": {
            "default": "split",
            "enum": [
              "split",
              "stack"
            ],
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ComposeSource"
          }
        },
        "required": [
          "source",
          "choices"
        ],
        "type": "object"
      },
      "ComposePlanService": {
        "additionalProperties": false,
        "properties": {
          "binds": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanBind"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "dependsOn": {
            "description": "Compose service names this service is deployed after",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "docker": {
            "$ref": "#/components/schemas/DockerOptions"
          },
          "domains": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanDomain"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "env": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanEnv"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "files": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanFile"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "health": {
            "$ref": "#/components/schemas/ComposePlanHealth"
          },
          "include": {
            "type": "boolean"
          },
          "includeNote": {
            "type": "string"
          },
          "key": {
            "description": "The service name in the Compose file",
            "type": "string"
          },
          "kind": {
            "enum": [
              "app",
              "worker",
              "database"
            ],
            "type": "string"
          },
          "managed": {
            "$ref": "#/components/schemas/ComposePlanManaged"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "needs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "networks": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "notes": {
            "items": {
              "$ref": "#/components/schemas/ComposeNote"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "oneShot": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "portHttp": {
            "type": "boolean"
          },
          "ports": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanPort"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "replicas": {
            "format": "int64",
            "type": "integer"
          },
          "replicasNote": {
            "type": "string"
          },
          "slug": {
            "description": "The slug the service will get (references use it)",
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ComposePlanSource"
          },
          "stopGraceSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "volumes": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanVolume"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "name",
          "slug",
          "include",
          "kind",
          "source",
          "port",
          "portHttp",
          "env",
          "volumes",
          "files",
          "binds",
          "ports",
          "domains",
          "replicas",
          "oneShot",
          "dependsOn",
          "networks",
          "notes",
          "needs"
        ],
        "type": "object"
      },
      "ComposePlanSource": {
        "additionalProperties": false,
        "properties": {
          "build": {
            "$ref": "#/components/schemas/ComposePlanBuild"
          },
          "image": {
            "type": "string"
          },
          "type": {
            "enum": [
              "image",
              "git",
              "managed"
            ],
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "ComposePlanVolume": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "enum": [
              "volume",
              "anonymous",
              "bind",
              "managed"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "note": {
            "type": "string"
          },
          "path": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "path",
          "from"
        ],
        "type": "object"
      },
      "ComposeRepoRef": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "description": "Default: the repository's default branch",
            "maxLength": 250,
            "type": "string"
          },
          "connectionId": {
            "type": "string"
          },
          "path": {
            "description": "Path of the Compose file in the repository; default docker-compose.yml",
            "maxLength": 500,
            "type": "string"
          },
          "repo": {
            "maxLength": 300,
            "type": "string"
          },
          "url": {
            "maxLength": 500,
            "type": "string"
          }
        },
        "type": "object"
      },
      "ComposeRewrite": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "host",
              "password",
              "auth"
            ],
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "service": {
            "type": "string"
          },
          "target": {
            "description": "The Compose service the reference points at",
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "service",
          "key",
          "kind",
          "target",
          "from",
          "to",
          "reason"
        ],
        "type": "object"
      },
      "ComposeServiceChoice": {
        "additionalProperties": false,
        "properties": {
          "connectionId": {
            "type": "string"
          },
          "convertBinds": {
            "description": "Container paths of directory bind mounts to turn into named volumes",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "domain": {
            "$ref": "#/components/schemas/ComposeDomainChoice"
          },
          "env": {
            "additionalProperties": {
              "$ref": "#/components/schemas/ComposeEnvChoice"
            },
            "type": "object"
          },
          "gitBranch": {
            "maxLength": 250,
            "type": "string"
          },
          "gitUrl": {
            "maxLength": 500,
            "type": "string"
          },
          "image": {
            "maxLength": 500,
            "type": "string"
          },
          "include": {
            "type": "boolean"
          },
          "managedDatabase": {
            "description": "Create a managed database instead of an image service",
            "type": "boolean"
          },
          "name": {
            "maxLength": 120,
            "type": "string"
          },
          "port": {
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "publishPorts": {
            "description": "Ports to publish through TCP/UDP routes, as \"5432/tcp\" (container port)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "repo": {
            "maxLength": 300,
            "type": "string"
          },
          "source": {
            "enum": [
              "image",
              "git"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "ComposeSource": {
        "additionalProperties": false,
        "properties": {
          "compose": {
            "maxLength": 262144,
            "type": "string"
          },
          "env": {
            "maxLength": 262144,
            "type": "string"
          },
          "files": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Referenced files by path, e.g. {\"./nginx.conf\": \"...\"}",
            "type": "object"
          },
          "name": {
            "maxLength": 120,
            "type": "string"
          },
          "repo": {
            "$ref": "#/components/schemas/ComposeRepoRef",
            "description": "Read the Compose file (and the files it references) from a git repository"
          }
        },
        "type": "object"
      },
      "ComposeStackComponent": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "description": "run: started by every deploy; profile: has Compose profiles and is not started by a default deploy",
            "enum": [
              "run",
              "profile"
            ],
            "type": "string"
          },
          "domains": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanDomain"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "image": {
            "type": "string"
          },
          "index": {
            "description": "Position among the components sorted by name",
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "description": "The service name in the Compose file; also the component's DNS name on the environment network",
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "ports": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "profiles": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "index",
          "ports",
          "profiles",
          "action",
          "port",
          "domains",
          "notes"
        ],
        "type": "object"
      },
      "ComposeStackPlan": {
        "additionalProperties": false,
        "properties": {
          "components": {
            "items": {
              "$ref": "#/components/schemas/ComposeStackComponent"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "composeAvailable": {
            "type": [
              "boolean",
              "null"
            ]
          },
          "name": {
            "description": "Name of the stack service",
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "slug": {
            "description": "The slug the stack will get",
            "type": "string"
          },
          "unrestricted": {
            "type": "boolean"
          },
          "variables": {
            "items": {
              "$ref": "#/components/schemas/ComposePlanEnv"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "violations": {
            "items": {
              "$ref": "#/components/schemas/Violation"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "slug",
          "components",
          "variables",
          "violations",
          "notes",
          "unrestricted",
          "composeAvailable"
        ],
        "type": "object"
      },
      "Config": {
        "additionalProperties": false,
        "properties": {
          "blockEgress": {
            "type": "boolean"
          },
          "buildContext": {
            "type": "string"
          },
          "buildLocation": {
            "type": "string"
          },
          "buildServerId": {
            "type": "string"
          },
          "buildType": {
            "type": "string"
          },
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "database": {
            "$ref": "#/components/schemas/Spec"
          },
          "docker": {
            "$ref": "#/components/schemas/DockerOptions"
          },
          "dockerfilePath": {
            "type": "string"
          },
          "files": {
            "items": {
              "$ref": "#/components/schemas/FileMount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "gitBranch": {
            "type": "string"
          },
          "gitUrl": {
            "type": "string"
          },
          "healthcheck": {
            "$ref": "#/components/schemas/Healthcheck"
          },
          "image": {
            "type": "string"
          },
          "imageRetention": {
            "format": "int64",
            "type": "integer"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "oneshot": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "postDeployCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "postDeployTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "preDeployCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "preDeployTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "registryId": {
            "type": "string"
          },
          "route": {
            "$ref": "#/components/schemas/RouteConfig"
          },
          "stack": {
            "$ref": "#/components/schemas/StackConfig"
          },
          "startCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "stopGraceSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "submodules": {
            "type": "string"
          },
          "tailnet": {
            "$ref": "#/components/schemas/TailnetConfig"
          }
        },
        "required": [
          "healthcheck",
          "stopGraceSeconds",
          "imageRetention"
        ],
        "type": "object"
      },
      "ConfigInput": {
        "additionalProperties": false,
        "properties": {
          "blockEgress": {
            "description": "Block outbound internet: the service only joins its environment's internal network. Omit to keep the current value on PATCH.",
            "type": "boolean"
          },
          "buildContext": {
            "type": "string"
          },
          "buildLocation": {
            "description": "Where a git source is built: inherit (project, then team default), target, or build_server (pushed to a registry; the target pulls by digest)",
            "enum": [
              "inherit",
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "buildServerId": {
            "description": "Pin the build server; omitted lets the control plane choose a sticky one",
            "type": "string"
          },
          "buildType": {
            "description": "How a git source is built: auto (Dockerfile if present, else Railpack), dockerfile, railpack or starter:\u003cnode|python|go|ruby|php|static\u003e",
            "examples": [
              "auto"
            ],
            "type": "string"
          },
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "docker": {
            "$ref": "#/components/schemas/DockerOptions",
            "description": "Typed container options. On every server: capAdd, capDrop, noNewPrivileges, readOnlyRootfs, pidsLimit, hostname (default: the service slug), dns, sysctls, hostSysctls (host requirements, only warned about), user, groupAdd, ulimits, shmSizeMb, extraHosts, labels, init, stopSignal, tmpfs, entrypoint. Only on a server an instance admin made unrestricted: devices, gpus, runtime, privileged, pidHost, seccompUnconfined, apparmorUnconfined and the capabilities NET_ADMIN and SYS_ADMIN (422 requires_unrestricted_server otherwise). Never host networking, ip, restart or log options, host binds or the socket."
          },
          "dockerfilePath": {
            "type": "string"
          },
          "files": {
            "items": {
              "$ref": "#/components/schemas/FileMount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "gitBranch": {
            "type": "string"
          },
          "gitUrl": {
            "type": "string"
          },
          "healthcheck": {
            "$ref": "#/components/schemas/HealthcheckInput"
          },
          "image": {
            "type": "string"
          },
          "imageRetention": {
            "format": "int64",
            "type": "integer"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "oneshot": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "postDeployCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "postDeployTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "preDeployCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "preDeployTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "registryId": {
            "description": "Registry the build is pushed to; omitted inherits the project or team default",
            "type": "string"
          },
          "stack": {
            "$ref": "#/components/schemas/StackConfigInput",
            "description": "The compose project of a stack: the compose file, per-component limits and the wait timeout. Components are derived by the server."
          },
          "startCommand": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "stopGraceSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "submodules": {
            "description": "Git submodules: auto (recursive when the commit has a .gitmodules file; a submodule that cannot be fetched is only a warning; the default), on (always; a failure fails the build) or off. Credentials: the repository's token or deploy key is used for submodules on the same host only; relative URLs and ssh:// submodules of an HTTPS repository on the same host work, other hosts are fetched anonymously over https",
            "enum": [
              "auto",
              "on",
              "off"
            ],
            "examples": [
              "auto"
            ],
            "type": "string"
          },
          "tailnet": {
            "$ref": "#/components/schemas/TailnetConfig"
          }
        },
        "type": "object"
      },
      "ConnectionView": {
        "additionalProperties": false,
        "properties": {
          "accountLogin": {
            "type": "string"
          },
          "authType": {
            "enum": [
              "github_app",
              "oauth",
              "token",
              "webhook_only"
            ],
            "type": "string"
          },
          "baseUrl": {
            "type": "string"
          },
          "canListRepos": {
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "github": {
            "$ref": "#/components/schemas/GitHubAppView"
          },
          "id": {
            "type": "string"
          },
          "manualWebhook": {
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "oauth": {
            "$ref": "#/components/schemas/OAuthView"
          },
          "provider": {
            "enum": [
              "github",
              "gitlab",
              "gitea",
              "forgejo",
              "bitbucket"
            ],
            "type": "string"
          },
          "serviceCount": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "enum": [
              "pending",
              "active",
              "error"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "supportsPreviews": {
            "type": "boolean"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "webhookUrl": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "provider",
          "name",
          "baseUrl",
          "authType",
          "status",
          "statusMessage",
          "accountLogin",
          "webhookUrl",
          "manualWebhook",
          "canListRepos",
          "supportsPreviews",
          "github",
          "oauth",
          "serviceCount",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "ConsumerRef": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "slug",
          "name"
        ],
        "type": "object"
      },
      "ConsumerView": {
        "additionalProperties": false,
        "properties": {
          "server": {
            "$ref": "#/components/schemas/MeshServerRef"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "slug",
          "server",
          "source",
          "state"
        ],
        "type": "object"
      },
      "CoolifyAppliedEnvironment": {
        "additionalProperties": false,
        "properties": {
          "created": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "created"
        ],
        "type": "object"
      },
      "CoolifyAppliedProject": {
        "additionalProperties": false,
        "properties": {
          "created": {
            "type": "boolean"
          },
          "environments": {
            "items": {
              "$ref": "#/components/schemas/CoolifyAppliedEnvironment"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "created",
          "environments"
        ],
        "type": "object"
      },
      "CoolifyAppliedService": {
        "additionalProperties": false,
        "properties": {
          "coolifyUuid": {
            "type": "string"
          },
          "envSlug": {
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "projectSlug": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "kind",
          "projectId",
          "projectSlug",
          "environmentId",
          "envSlug",
          "coolifyUuid"
        ],
        "type": "object"
      },
      "CoolifyApplyRequest": {
        "additionalProperties": false,
        "properties": {
          "choices": {
            "$ref": "#/components/schemas/CoolifyChoices"
          },
          "deploy": {
            "type": "boolean"
          },
          "serverId": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/CoolifySource"
          }
        },
        "required": [
          "source",
          "choices",
          "serverId"
        ],
        "type": "object"
      },
      "CoolifyApplyResult": {
        "additionalProperties": false,
        "properties": {
          "deployments": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "followups": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "projects": {
            "items": {
              "$ref": "#/components/schemas/CoolifyAppliedProject"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rewrites": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanRewrite"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/CoolifyAppliedService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "projects",
          "services",
          "deployments",
          "rewrites",
          "warnings",
          "followups"
        ],
        "type": "object"
      },
      "CoolifyCheck": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "status": {
            "enum": [
              "ok",
              "warn",
              "fail"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "message"
        ],
        "type": "object"
      },
      "CoolifyChoices": {
        "additionalProperties": false,
        "properties": {
          "gitConnectionId": {
            "type": "string"
          },
          "projects": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyProjectChoice"
            },
            "type": "object"
          },
          "registries": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyRegistryAuth"
            },
            "type": "object"
          },
          "resources": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyResourceChoice"
            },
            "type": "object"
          }
        },
        "type": "object"
      },
      "CoolifyDomainChoice": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "CoolifyEnvChoice": {
        "additionalProperties": false,
        "properties": {
          "rewrite": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          },
          "skip": {
            "type": "boolean"
          },
          "value": {
            "description": "Write-only",
            "type": "string"
          }
        },
        "type": "object"
      },
      "CoolifyEnvironmentChoice": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "skip": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "CoolifyNote": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "description": "What the note is about: a field, option or variable name",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warning",
              "danger"
            ],
            "type": "string"
          }
        },
        "required": [
          "key",
          "severity",
          "message"
        ],
        "type": "object"
      },
      "CoolifyPlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "checks": {
            "items": {
              "$ref": "#/components/schemas/CoolifyCheck"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "coolifyVersion": {
            "type": "string"
          },
          "followups": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "installable": {
            "type": "boolean"
          },
          "projects": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanProject"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "registries": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanRegistry"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rewrites": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanRewrite"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "totals": {
            "$ref": "#/components/schemas/CoolifyTotals"
          },
          "unsupported": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanUnsupported"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "projects",
          "unsupported",
          "registries",
          "rewrites",
          "checks",
          "warnings",
          "blockers",
          "followups",
          "installable",
          "totals"
        ],
        "type": "object"
      },
      "CoolifyPlanDomain": {
        "additionalProperties": false,
        "properties": {
          "compress": {
            "type": "boolean"
          },
          "conflict": {
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "forceHttps": {
            "type": "boolean"
          },
          "generate": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          },
          "noindex": {
            "type": "boolean"
          },
          "note": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "host",
          "enabled",
          "forceHttps"
        ],
        "type": "object"
      },
      "CoolifyPlanEnv": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "needsValue": {
            "type": "boolean"
          },
          "note": {
            "type": "string"
          },
          "rewritten": {
            "type": "boolean"
          },
          "scope": {
            "enum": [
              "runtime",
              "build",
              "both"
            ],
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          },
          "secretReason": {
            "type": "string"
          },
          "skipped": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "scope",
          "secret"
        ],
        "type": "object"
      },
      "CoolifyPlanEnvironment": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "create",
              "existing",
              "skip"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "production": {
            "type": "boolean"
          },
          "resources": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanResource"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "slug",
          "action",
          "production",
          "resources"
        ],
        "type": "object"
      },
      "CoolifyPlanGit": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "type": "string"
          },
          "buildContext": {
            "type": "string"
          },
          "buildType": {
            "type": "string"
          },
          "dockerfilePath": {
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url",
          "branch",
          "buildType"
        ],
        "type": "object"
      },
      "CoolifyPlanHealth": {
        "additionalProperties": false,
        "properties": {
          "deadlineSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "intervalSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "path": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "startPeriodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "enum": [
              "http",
              "tcp",
              "docker",
              "exec",
              "none"
            ],
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "CoolifyPlanManaged": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "type": "string"
          },
          "engine": {
            "type": "string"
          },
          "flavor": {
            "type": "string"
          },
          "from": {
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "username": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "engine",
          "version",
          "from",
          "notes"
        ],
        "type": "object"
      },
      "CoolifyPlanProject": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "create",
              "existing",
              "skip"
            ],
            "type": "string"
          },
          "collision": {
            "type": "boolean"
          },
          "environments": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanEnvironment"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "existingId": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "uuid": {
            "type": "string"
          }
        },
        "required": [
          "uuid",
          "name",
          "slug",
          "action",
          "collision",
          "environments"
        ],
        "type": "object"
      },
      "CoolifyPlanRegistry": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "type": "string"
          },
          "provided": {
            "type": "boolean"
          },
          "services": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "host",
          "services",
          "provided"
        ],
        "type": "object"
      },
      "CoolifyPlanRequest": {
        "additionalProperties": false,
        "properties": {
          "choices": {
            "$ref": "#/components/schemas/CoolifyChoices"
          },
          "serverId": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/CoolifySource"
          }
        },
        "required": [
          "source",
          "choices"
        ],
        "type": "object"
      },
      "CoolifyPlanResource": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "dependsOn": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "docker": {
            "$ref": "#/components/schemas/DockerOptions"
          },
          "domains": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanDomain"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "env": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanEnv"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "followup": {
            "type": "string"
          },
          "health": {
            "$ref": "#/components/schemas/CoolifyPlanHealth"
          },
          "include": {
            "type": "boolean"
          },
          "includeNote": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "app",
              "worker",
              "database"
            ],
            "type": "string"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "needsUnrestricted": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "notes": {
            "items": {
              "$ref": "#/components/schemas/CoolifyNote"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "postDeploy": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "preDeploy": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "slug": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/CoolifyPlanSource"
          },
          "unsupported": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "uuid": {
            "type": "string"
          },
          "volumes": {
            "items": {
              "$ref": "#/components/schemas/CoolifyPlanVolume"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "uuid",
          "kind",
          "name",
          "slug",
          "include",
          "source",
          "domains",
          "volumes",
          "needsUnrestricted",
          "env",
          "dependsOn",
          "unsupported",
          "notes"
        ],
        "type": "object"
      },
      "CoolifyPlanRewrite": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "host",
              "password",
              "user",
              "port",
              "database",
              "url"
            ],
            "type": "string"
          },
          "resource": {
            "type": "string"
          },
          "to": {
            "description": "The reference the value now uses, for example ${{db.DATABASE_HOST}}",
            "type": "string"
          }
        },
        "required": [
          "resource",
          "key",
          "kind",
          "to"
        ],
        "type": "object"
      },
      "CoolifyPlanSource": {
        "additionalProperties": false,
        "properties": {
          "git": {
            "$ref": "#/components/schemas/CoolifyPlanGit"
          },
          "image": {
            "type": "string"
          },
          "managed": {
            "$ref": "#/components/schemas/CoolifyPlanManaged"
          },
          "registry": {
            "type": "string"
          },
          "type": {
            "enum": [
              "image",
              "git",
              "managed"
            ],
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "CoolifyPlanUnsupported": {
        "additionalProperties": false,
        "properties": {
          "kind": {
            "enum": [
              "service",
              "database",
              "application",
              "other"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "project": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          }
        },
        "required": [
          "kind",
          "name",
          "reason"
        ],
        "type": "object"
      },
      "CoolifyPlanVolume": {
        "additionalProperties": false,
        "properties": {
          "mountPath": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "mountPath"
        ],
        "type": "object"
      },
      "CoolifyProjectChoice": {
        "additionalProperties": false,
        "properties": {
          "environments": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyEnvironmentChoice"
            },
            "type": "object"
          },
          "existingProjectId": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "skip": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "CoolifyRegistryAuth": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "description": "Write-only",
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "username",
          "password"
        ],
        "type": "object"
      },
      "CoolifyResourceChoice": {
        "additionalProperties": false,
        "properties": {
          "domains": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyDomainChoice"
            },
            "type": "object"
          },
          "engineVersion": {
            "type": "string"
          },
          "env": {
            "additionalProperties": {
              "$ref": "#/components/schemas/CoolifyEnvChoice"
            },
            "type": "object"
          },
          "include": {
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "app",
              "worker"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "CoolifySource": {
        "additionalProperties": false,
        "properties": {
          "token": {
            "description": "Coolify API token with the read and read:sensitive abilities. Never stored or returned.",
            "minLength": 1,
            "type": "string"
          },
          "url": {
            "description": "Address of the Coolify instance, for example https://coolify.example.com",
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "url",
          "token"
        ],
        "type": "object"
      },
      "CoolifyTotals": {
        "additionalProperties": false,
        "properties": {
          "databases": {
            "format": "int64",
            "type": "integer"
          },
          "domains": {
            "format": "int64",
            "type": "integer"
          },
          "projects": {
            "format": "int64",
            "type": "integer"
          },
          "secrets": {
            "format": "int64",
            "type": "integer"
          },
          "services": {
            "format": "int64",
            "type": "integer"
          },
          "variables": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "projects",
          "services",
          "databases",
          "variables",
          "secrets",
          "domains"
        ],
        "type": "object"
      },
      "CoordinatorView": {
        "additionalProperties": false,
        "properties": {
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "ok": {
            "description": "null until checked",
            "type": [
              "boolean",
              "null"
            ]
          }
        },
        "required": [
          "ok",
          "checkedAt"
        ],
        "type": "object"
      },
      "CreateBackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "destinationId": {
            "type": "string"
          }
        },
        "required": [
          "destinationId"
        ],
        "type": "object"
      },
      "CreateChannelInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig"
          },
          "enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "email",
              "slack",
              "discord",
              "telegram",
              "webhook"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "rule": {
            "$ref": "#/components/schemas/ChannelRuleInput",
            "description": "Default: failures and alerts on, successes off, the whole workspace, every severity."
          },
          "secrets": {
            "$ref": "#/components/schemas/ChannelSecretsInput"
          }
        },
        "required": [
          "name",
          "kind"
        ],
        "type": "object"
      },
      "CreateChannelOutputBody": {
        "additionalProperties": false,
        "properties": {
          "channel": {
            "$ref": "#/components/schemas/ChannelView"
          },
          "signingSecret": {
            "description": "Webhook channels: the generated signing secret. Shown only in this response; store it now. Rotate it to get a new one.",
            "type": "string"
          }
        },
        "required": [
          "channel"
        ],
        "type": "object"
      },
      "CreateConnectionInputBody": {
        "additionalProperties": false,
        "properties": {
          "authType": {
            "description": "token: a personal/group access token (needs api scope on GitLab; repository, webhook and status access on Gitea and Forgejo). oauth: an OAuth application. Ignored for Bitbucket.",
            "enum": [
              "token",
              "oauth"
            ],
            "type": "string"
          },
          "baseUrl": {
            "description": "The instance's web URL. Required for Gitea and Forgejo; defaults to https://gitlab.com and https://bitbucket.org",
            "maxLength": 300,
            "type": "string"
          },
          "clientId": {
            "description": "OAuth application client id",
            "maxLength": 200,
            "type": "string"
          },
          "clientSecret": {
            "description": "Write-only OAuth application client secret",
            "maxLength": 512,
            "type": "string"
          },
          "name": {
            "description": "Defaults to the provider and host",
            "maxLength": 80,
            "type": "string"
          },
          "provider": {
            "description": "GitHub connects through a GitHub App: use POST /git/github/manifest",
            "enum": [
              "gitlab",
              "gitea",
              "forgejo",
              "bitbucket"
            ],
            "type": "string"
          },
          "token": {
            "description": "Write-only access token (authType token; for Bitbucket an optional repository access token to clone private repositories)",
            "maxLength": 512,
            "type": "string"
          }
        },
        "required": [
          "provider"
        ],
        "type": "object"
      },
      "CreateConnectionResult": {
        "additionalProperties": false,
        "properties": {
          "authorizeUrl": {
            "type": "string"
          },
          "connection": {
            "$ref": "#/components/schemas/ConnectionView"
          },
          "webhookSecret": {
            "type": "string"
          }
        },
        "required": [
          "connection",
          "webhookSecret",
          "authorizeUrl"
        ],
        "type": "object"
      },
      "CreateCredentialInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "Unique per team",
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "provider": {
            "description": "The lego provider code: one of GET /dns/providers or GET /dns/lego-providers",
            "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
            "type": "string"
          },
          "serverId": {
            "description": "Scope the credential to one server; omit for the whole team",
            "type": "string"
          },
          "values": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Provider variables by name (see GET /dns/providers and GET /dns/lego-providers). Write-only: sealed at rest, never returned.",
            "type": "object"
          }
        },
        "required": [
          "name",
          "provider",
          "values"
        ],
        "type": "object"
      },
      "CreateDatabaseInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptLicense": {
            "description": "Required for engines with a source-available licence (MongoDB, Redis)",
            "type": "boolean"
          },
          "databaseName": {
            "pattern": "^[a-z_][a-z0-9_]{0,62}$",
            "type": "string"
          },
          "engine": {
            "description": "Valkey is the default key-value engine",
            "enum": [
              "postgres",
              "mysql",
              "mariadb",
              "valkey",
              "redis",
              "mongodb",
              "clickhouse"
            ],
            "type": "string"
          },
          "flavor": {
            "description": "Image variant, e.g. postgis for PostgreSQL",
            "enum": [
              "postgis"
            ],
            "type": "string"
          },
          "name": {
            "description": "Display name; defaults to the engine name",
            "maxLength": 100,
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "version": {
            "description": "Major version; omitted means the engine's default",
            "type": "string"
          }
        },
        "required": [
          "engine"
        ],
        "type": "object"
      },
      "CreateDestinationInputBody": {
        "additionalProperties": false,
        "properties": {
          "accessKey": {
            "description": "Write-only.",
            "type": "string"
          },
          "bucket": {
            "type": "string"
          },
          "compatMode": {
            "description": "Limit SDK checksums for non-AWS stores. Default: on when an endpoint is set.",
            "type": "boolean"
          },
          "endpoint": {
            "description": "S3-compatible endpoint URL; empty means AWS S3.",
            "type": "string"
          },
          "kind": {
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "localDir": {
            "description": "Local destinations: relative sub-directory of the agent's backup directory.",
            "type": "string"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "pathStyle": {
            "description": "Use path-style addressing (MinIO, SeaweedFS, Garage, most self-hosted stores).",
            "type": "boolean"
          },
          "prefix": {
            "description": "Key prefix inside the bucket or directory.",
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "secretKey": {
            "description": "Write-only.",
            "type": "string"
          }
        },
        "required": [
          "name",
          "kind"
        ],
        "type": "object"
      },
      "CreateDrainInputBody": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "description": "Default true: every project of the team. false: only projectIds.",
            "type": "boolean"
          },
          "bufferMb": {
            "description": "Undelivered backlog kept on disk per server (default 256, min 8).",
            "format": "int64",
            "maximum": 5120,
            "minimum": 0,
            "type": "integer"
          },
          "config": {
            "$ref": "#/components/schemas/DrainConfigBody"
          },
          "enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "loki",
              "otlp",
              "syslog",
              "http"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "projectIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "query": {
            "description": "Only ship lines matching this log search query.",
            "type": "string"
          },
          "secrets": {
            "$ref": "#/components/schemas/LogDrainSecretsInput"
          },
          "serviceIds": {
            "description": "Narrow the scope to these services.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "kind",
          "config"
        ],
        "type": "object"
      },
      "CreateDumpRestoreInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirmSlug": {
            "description": "In-place restores: the database's slug.",
            "type": "string"
          },
          "destinationId": {
            "description": "In-place restores: the backup destination of the safety backup; default the destination of the database's backup schedule.",
            "type": "string"
          },
          "fileName": {
            "description": "The name of the file about to be uploaded (shown in the history).",
            "type": "string"
          },
          "mode": {
            "default": "new",
            "description": "new: restore into a new sibling database (default, the original is untouched). in_place: replace this database's data after a safety backup.",
            "enum": [
              "new",
              "in_place"
            ],
            "type": "string"
          },
          "name": {
            "description": "Name of the new database (mode new).",
            "type": "string"
          },
          "serverId": {
            "description": "Server for the new database (mode new); default the source's server.",
            "type": "string"
          },
          "sizeBytes": {
            "description": "The size of the file about to be uploaded. A file above the limit is refused before anything is created.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "CreateEnvironmentInputBody": {
        "additionalProperties": false,
        "properties": {
          "isProduction": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateInputBody": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "Vault or OpenBao address, e.g. https://vault.example.com:8200",
            "type": "string"
          },
          "approleMount": {
            "description": "AppRole auth mount (default approle)",
            "type": "string"
          },
          "authMethod": {
            "description": "token (default) or approle",
            "enum": [
              "token",
              "approle"
            ],
            "type": "string"
          },
          "caCert": {
            "description": "PEM certificate(s) to trust for a private CA (public material)",
            "type": "string"
          },
          "clientId": {
            "description": "Machine identity client id (universal auth)",
            "type": "string"
          },
          "defaultConfig": {
            "description": "Doppler config used by references that name none (with defaultProject)",
            "type": "string"
          },
          "defaultProject": {
            "description": "Doppler project used by references that name none, like doppler:\u003cname\u003e#KEY. Set with defaultConfig, or leave both empty (a service token is bound to one config)",
            "type": "string"
          },
          "grants": {
            "description": "With scope selected: the projects (or single environments) allowed to reference the integration. At least one.",
            "items": {
              "$ref": "#/components/schemas/ScopeGrant"
            },
            "maxItems": 200,
            "type": [
              "array",
              "null"
            ]
          },
          "kind": {
            "description": "vault covers HashiCorp Vault and OpenBao (KV v2); doppler is Doppler (service token, or a personal / service account token with a project and config)",
            "enum": [
              "vault",
              "infisical",
              "doppler"
            ],
            "type": "string"
          },
          "mount": {
            "description": "KV v2 mount path (default secret)",
            "type": "string"
          },
          "name": {
            "description": "Lowercase letters, digits and dashes; it appears in references as vault:\u003cname\u003e/… or doppler:\u003cname\u003e/…",
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          },
          "namespace": {
            "description": "Vault Enterprise / OpenBao namespace (X-Vault-Namespace)",
            "type": "string"
          },
          "organizationSlug": {
            "description": "Optional organization slug to scope the login to",
            "type": "string"
          },
          "projectId": {
            "description": "Infisical project id",
            "type": "string"
          },
          "roleId": {
            "description": "AppRole role id",
            "type": "string"
          },
          "scope": {
            "description": "team (default on create): every project may reference the integration. selected: only the projects and environments in grants. Omit on update to keep the stored scope.",
            "enum": [
              "team",
              "selected"
            ],
            "type": "string"
          },
          "secret": {
            "description": "Write-only: the Vault token (token auth), the AppRole secret id, the Infisical client secret or the Doppler token. Omit on update to keep the stored one.",
            "maxLength": 4096,
            "type": "string"
          },
          "siteUrl": {
            "description": "Infisical URL (default https://us.infisical.com) or Doppler API URL (default https://api.doppler.com)",
            "type": "string"
          }
        },
        "required": [
          "name",
          "kind"
        ],
        "type": "object"
      },
      "CreateInputBody1": {
        "additionalProperties": false,
        "properties": {
          "addPrefix": {
            "description": "Prepend this path before forwarding to the service",
            "maxLength": 200,
            "type": "string"
          },
          "certificateId": {
            "description": "An uploaded certificate of the service's server whose names cover the hostname; empty clears the pin",
            "type": "string"
          },
          "component": {
            "description": "Compose stacks only (required for them): the component (compose service) the domain routes to",
            "maxLength": 63,
            "type": "string"
          },
          "dnsResolver": {
            "description": "DNS-01 provider (a lego provider code) that obtains the certificate; the server must have a resolver for it. Empty = HTTP-01 or a covering wildcard certificate",
            "pattern": "^([a-z0-9][a-z0-9-]{0,39})?$",
            "type": "string"
          },
          "hostname": {
            "maxLength": 253,
            "minLength": 3,
            "type": "string"
          },
          "kind": {
            "description": "serve routes to the service; redirect answers with a redirect to redirectTo",
            "enum": [
              "serve",
              "redirect"
            ],
            "type": "string"
          },
          "options": {
            "$ref": "#/components/schemas/RouteOptions",
            "description": "Replaces the whole option set"
          },
          "pathPrefix": {
            "description": "Serve only this path (and below), e.g. /api. Empty = the whole host",
            "maxLength": 200,
            "type": "string"
          },
          "preservePath": {
            "description": "A redirect keeps the request path and query (default true)",
            "type": "boolean"
          },
          "redirectCode": {
            "enum": [
              301,
              302,
              307,
              308
            ],
            "format": "int64",
            "type": "integer"
          },
          "redirectTo": {
            "description": "Target hostname of a redirect (not a URL)",
            "maxLength": 253,
            "type": "string"
          },
          "stripPrefix": {
            "description": "Remove the path prefix before forwarding to the service",
            "type": "boolean"
          },
          "targetPort": {
            "description": "Defaults to, and must equal, the service port. Compose stacks: the container port of the component; optional when the component declares exactly one port",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "tlsMode": {
            "description": "auto = ACME or the default certificate, custom = an uploaded certificate, none = plain HTTP only",
            "enum": [
              "auto",
              "custom",
              "none"
            ],
            "type": "string"
          },
          "wwwRedirect": {
            "description": "true creates (false removes) a whole-host 301 redirect from the www/apex counterpart of this hostname (www.\u003chost\u003e, or the host without www.) to this domain. Both hostnames are routed and get certificates; each needs its own DNS record. Needs a whole-host serve domain (422 invalid_www_redirect)",
            "type": "boolean"
          }
        },
        "required": [
          "hostname"
        ],
        "type": "object"
      },
      "CreateInputBody2": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "description": "registry.example.com or registry.example.com:5000, without a scheme or path. ghcr.io, docker.io, registry.gitlab.com, a Harbor or self-hosted host.",
            "maxLength": 253,
            "minLength": 1,
            "type": "string"
          },
          "name": {
            "description": "Unique name in the team.",
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "namespace": {
            "description": "The path between the host and the repository name: a GitHub user or organization, a Docker Hub namespace, a GitLab group/project. Images are pushed to \u003chost\u003e/\u003cnamespace\u003e/\u003cproject\u003e-\u003cservice\u003e.",
            "maxLength": 200,
            "type": "string"
          },
          "pullPassword": {
            "description": "Write-only, never returned.",
            "maxLength": 4096,
            "type": "string"
          },
          "pullUsername": {
            "description": "Optional read-only credential the target servers pull with. Without it they use the push credential.",
            "maxLength": 4096,
            "type": "string"
          },
          "pushPassword": {
            "description": "Write-only: a token or password, never returned.",
            "maxLength": 4096,
            "minLength": 1,
            "type": "string"
          },
          "pushUsername": {
            "description": "Write-only credential used to push images (basic auth). A registry without authentication takes any pair.",
            "maxLength": 4096,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name",
          "host",
          "pushUsername",
          "pushPassword"
        ],
        "type": "object"
      },
      "CreateInviteInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "description": "Mail the invite to this address (single use). Omit for a link invite.",
            "maxLength": 254,
            "type": "string"
          },
          "expiresInDays": {
            "description": "Default 7",
            "format": "int64",
            "maximum": 90,
            "minimum": 0,
            "type": "integer"
          },
          "maxUses": {
            "description": "Link invites: how many people may use it (default 1)",
            "format": "int64",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "projectIds": {
            "description": "Restrict the new member to these projects (developer and viewer only)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          }
        },
        "required": [
          "role"
        ],
        "type": "object"
      },
      "CreateLinkInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptMeshChanges": {
            "description": "Confirm the tailnet devices a link between services on different servers adds; without it the request fails with mesh_confirmation_required when devices would be added",
            "type": "boolean"
          },
          "fromServiceId": {
            "type": "string"
          },
          "toServiceId": {
            "type": "string"
          }
        },
        "required": [
          "fromServiceId",
          "toServiceId"
        ],
        "type": "object"
      },
      "CreateNetworkInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "description": "Unique per team; letters, digits, spaces, '.', '_' and '-'",
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          },
          "serverId": {
            "description": "The server the network lives on; only services on this server can attach",
            "type": "string"
          }
        },
        "required": [
          "name",
          "serverId"
        ],
        "type": "object"
      },
      "CreateProjectInputBody": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "maxLength": 500,
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateRouteInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "description": "tcp routes: client networks allowed; UDP cannot be restricted",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "denyCidrs": {
            "description": "tcp routes: client networks refused first, even when allowCidrs admits them; UDP cannot be restricted",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "domains": {
            "description": "Hostnames of an http route (staged; refine each with PATCH /domains/{id})",
            "items": {
              "$ref": "#/components/schemas/DomainInput"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "healthPath": {
            "description": "Enables a proxy health check on this path",
            "maxLength": 200,
            "type": "string"
          },
          "insecureSkipVerify": {
            "description": "https upstreams: do not verify the upstream certificate",
            "type": "boolean"
          },
          "listenPort": {
            "description": "tcp/udp routes: host port on the server (1024-65535)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "openToInternet": {
            "description": "tcp/udp routes: required when allowCidrs is empty",
            "type": "boolean"
          },
          "passHost": {
            "description": "false rewrites the Host header to the upstream's (default true)",
            "type": "boolean"
          },
          "protocol": {
            "enum": [
              "http",
              "tcp",
              "udp"
            ],
            "type": "string"
          },
          "proxyProtocol": {
            "description": "tcp routes: PROXY protocol version sent to the upstream",
            "enum": [
              0,
              1,
              2
            ],
            "format": "int64",
            "type": "integer"
          },
          "scheme": {
            "description": "http routes: scheme used towards the upstream",
            "enum": [
              "http",
              "https"
            ],
            "type": "string"
          },
          "serverId": {
            "description": "The server that publishes the route (required)",
            "type": "string"
          },
          "serverName": {
            "description": "https upstreams: TLS server name",
            "maxLength": 253,
            "type": "string"
          },
          "upstreams": {
            "description": "1-20 upstreams",
            "items": {
              "$ref": "#/components/schemas/UpstreamInput"
            },
            "type": "array"
          },
          "verifySkip": {
            "description": "Skip the post-deploy HTTP verification (upstreams that legitimately answer 5xx)",
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "serverId",
          "protocol"
        ],
        "type": "object"
      },
      "CreateScheduleInputBody": {
        "additionalProperties": false,
        "properties": {
          "cron": {
            "description": "5-field cron expression or @hourly/@daily/@weekly/@monthly/@yearly. At most one run every 5 minutes.",
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "retentionCount": {
            "description": "Keep the newest N successful backups (default 7, 0 = no limit).",
            "format": "int64",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "retentionDays": {
            "description": "Delete backups older than N days (0 = no limit).",
            "format": "int64",
            "maximum": 3650,
            "minimum": 0,
            "type": "integer"
          },
          "timezone": {
            "description": "IANA zone, default UTC.",
            "type": "string"
          }
        },
        "required": [
          "destinationId",
          "cron"
        ],
        "type": "object"
      },
      "CreateServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ConfigInput"
          },
          "gitToken": {
            "description": "Write-only access token for private HTTPS repositories",
            "type": "string"
          },
          "kind": {
            "enum": [
              "app",
              "worker",
              "database",
              "stack"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "registryAuth": {
            "$ref": "#/components/schemas/RegistryAuthInput",
            "description": "Write-only credentials for a private registry"
          },
          "serverId": {
            "type": "string"
          },
          "sourceType": {
            "enum": [
              "image",
              "git",
              "compose"
            ],
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateTaskInputBody": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "description": "Argv, run without a shell in a container of the service's current image. Wrap in [\"sh\",\"-c\",…] for shell syntax.",
            "items": {
              "type": "string"
            },
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "concurrency": {
            "description": "forbid (default) skips a tick while the previous run is still active.",
            "enum": [
              "forbid",
              "allow"
            ],
            "type": "string"
          },
          "enabled": {
            "description": "Default true.",
            "type": "boolean"
          },
          "name": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "schedule": {
            "description": "5-field cron expression (minute hour day-of-month month day-of-week) or @hourly/@daily/@weekly/@monthly/@yearly, evaluated in timezone.",
            "examples": [
              "*/15 * * * *"
            ],
            "type": "string"
          },
          "timeoutSeconds": {
            "description": "Default 1800 (30 minutes).",
            "format": "int64",
            "maximum": 86400,
            "minimum": 0,
            "type": "integer"
          },
          "timezone": {
            "description": "IANA time zone the schedule is evaluated in, e.g. Europe/Berlin. Default UTC.",
            "examples": [
              "Europe/Berlin"
            ],
            "maxLength": 64,
            "type": "string"
          }
        },
        "required": [
          "name",
          "schedule",
          "command"
        ],
        "type": "object"
      },
      "CreateTeamInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateTokenInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowProductionWithoutApproval": {
            "description": "MCP calls with this token skip the human approval production changes otherwise need. Owner or Admin only; audited. Off by default.",
            "type": "boolean"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "projectIds": {
            "description": "Restrict the token to these projects; omit for all projects",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requireProductionApproval": {
            "description": "Calls with this token on production environments need a human approval first. REST tokens are exempt by default so CI and deploy scripts keep working.",
            "type": "boolean"
          },
          "scopes": {
            "description": "projects:read, logs:read, projects:write, deployments:write, deployments:rollback, servers:read, servers:write, proxy:write, admin",
            "items": {
              "type": "string"
            },
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "scopes"
        ],
        "type": "object"
      },
      "CreateTokenInputBody1": {
        "additionalProperties": false,
        "properties": {
          "acmeEmail": {
            "maxLength": 254,
            "type": "string"
          },
          "baseDomain": {
            "maxLength": 253,
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "publicIp": {
            "maxLength": 45,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "CreateVolumeBackupInputBody": {
        "additionalProperties": false,
        "type": "object"
      },
      "CreateVolumeInputBody": {
        "additionalProperties": false,
        "properties": {
          "mountPath": {
            "maxLength": 512,
            "minLength": 2,
            "type": "string"
          },
          "name": {
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name",
          "mountPath"
        ],
        "type": "object"
      },
      "CreateWildcardInputBody": {
        "additionalProperties": false,
        "properties": {
          "coverGenerated": {
            "description": "Generated domains under the base domain use this certificate",
            "type": "boolean"
          },
          "default": {
            "description": "Make it the proxy's default certificate",
            "type": "boolean"
          },
          "domain": {
            "description": "Base domain; the certificate covers *.\u003cdomain\u003e",
            "maxLength": 253,
            "minLength": 3,
            "type": "string"
          },
          "includeApex": {
            "description": "Also cover the base domain itself",
            "type": "boolean"
          },
          "provider": {
            "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
            "type": "string"
          }
        },
        "required": [
          "domain",
          "provider",
          "includeApex"
        ],
        "type": "object"
      },
      "CreatedInvite": {
        "additionalProperties": false,
        "properties": {
          "delivery": {
            "enum": [
              "sent",
              "link_only",
              "not_configured",
              "failed"
            ],
            "type": "string"
          },
          "emailError": {
            "type": "string"
          },
          "invite": {
            "$ref": "#/components/schemas/TeamInvite"
          },
          "link": {
            "description": "Where the invitee accepts: an absolute URL when NEBULACTRL_PUBLIC_URL is set, otherwise a path",
            "type": "string"
          },
          "token": {
            "description": "The raw invite token. Shown once.",
            "type": "string"
          }
        },
        "required": [
          "invite",
          "token",
          "link",
          "delivery"
        ],
        "type": "object"
      },
      "CreatedToken": {
        "additionalProperties": false,
        "properties": {
          "allowProductionWithoutApproval": {
            "description": "MCP calls with this token skip the production approval. Set by an Owner or Admin when the token is created.",
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastUsedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "prefix": {
            "description": "First 8 characters after nct_, for identification",
            "type": "string"
          },
          "projectIds": {
            "description": "Absent when the token can access all projects",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requireProductionApproval": {
            "description": "Calls with this token on production environments need a human approval first (REST tokens are exempt by default so CI keeps working).",
            "type": "boolean"
          },
          "revokedAt": {
            "format": "date-time",
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "token": {
            "description": "The raw API token. Shown once; store it now.",
            "type": "string"
          }
        },
        "required": [
          "token",
          "id",
          "name",
          "prefix",
          "scopes",
          "createdAt",
          "allowProductionWithoutApproval",
          "requireProductionApproval"
        ],
        "type": "object"
      },
      "CredentialsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DNSCredential"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DNSCredential": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "fields": {
            "items": {
              "$ref": "#/components/schemas/DNSCredentialField"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "provider": {
            "description": "The lego provider code",
            "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
            "type": "string"
          },
          "providerName": {
            "type": "string"
          },
          "rev": {
            "description": "Advances whenever the values change",
            "format": "int64",
            "type": "integer"
          },
          "scope": {
            "description": "team: usable on every server of the team; server: only on ServerID",
            "enum": [
              "team",
              "server"
            ],
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "usedBy": {
            "items": {
              "$ref": "#/components/schemas/DNSCredentialUse"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "scope",
          "serverId",
          "name",
          "provider",
          "providerName",
          "fields",
          "rev",
          "usedBy",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "DNSCredentialField": {
        "additionalProperties": false,
        "properties": {
          "env": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "required": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          },
          "set": {
            "type": "boolean"
          },
          "value": {
            "description": "Only non-secret variables, and only for administrators",
            "type": "string"
          }
        },
        "required": [
          "env",
          "label",
          "secret",
          "required",
          "set"
        ],
        "type": "object"
      },
      "DNSCredentialUse": {
        "additionalProperties": false,
        "properties": {
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          }
        },
        "required": [
          "serverId",
          "serverName"
        ],
        "type": "object"
      },
      "DNSField": {
        "additionalProperties": false,
        "properties": {
          "env": {
            "type": "string"
          },
          "help": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "required": {
            "type": "boolean"
          },
          "secret": {
            "description": "Secret values are write-only: never returned by any read",
            "type": "boolean"
          }
        },
        "required": [
          "env",
          "label",
          "secret",
          "required"
        ],
        "type": "object"
      },
      "DNSProviderSpec": {
        "additionalProperties": false,
        "properties": {
          "aliases": {
            "description": "Other names lego accepts for the provider; a credential uses the code",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "code": {
            "description": "The lego provider code",
            "type": "string"
          },
          "docs": {
            "description": "The lego documentation page of the provider",
            "type": "string"
          },
          "fields": {
            "items": {
              "$ref": "#/components/schemas/DNSField"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "generic": {
            "description": "A lego provider without a curated form: variables are free-form, validated against lego's catalog",
            "type": "boolean"
          },
          "help": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "oneOf": {
            "description": "Alternative authentication methods; set every variable of at least one",
            "items": {
              "items": {
                "type": "string"
              },
              "type": [
                "array",
                "null"
              ]
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "code",
          "name",
          "docs",
          "generic",
          "fields"
        ],
        "type": "object"
      },
      "DNSResolverView": {
        "additionalProperties": false,
        "properties": {
          "change": {
            "description": "Staged change awaiting Deploy proxy",
            "enum": [
              "none",
              "add",
              "update",
              "remove"
            ],
            "type": "string"
          },
          "credentialId": {
            "type": "string"
          },
          "credentialName": {
            "type": "string"
          },
          "delaySeconds": {
            "description": "Wait this long before checking the TXT record has propagated",
            "format": "int64",
            "type": "integer"
          },
          "provider": {
            "description": "The lego provider code",
            "type": "string"
          },
          "providerName": {
            "type": "string"
          },
          "rotated": {
            "description": "The credential's values changed since the proxy applied it",
            "type": "boolean"
          },
          "staging": {
            "description": "Use the Let's Encrypt staging CA: certificates are not trusted by browsers",
            "type": "boolean"
          }
        },
        "required": [
          "provider",
          "providerName",
          "credentialId",
          "credentialName",
          "delaySeconds",
          "staging",
          "change",
          "rotated"
        ],
        "type": "object"
      },
      "DNSStatus": {
        "additionalProperties": false,
        "properties": {
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "configured": {
            "description": "The team has a Cloudflare connection",
            "type": "boolean"
          },
          "conflict": {
            "description": "Why adopting is impossible (for example a CNAME next to an A record)",
            "type": "string"
          },
          "desired": {
            "$ref": "#/components/schemas/RecordView"
          },
          "effectiveProxied": {
            "type": "boolean"
          },
          "error": {
            "description": "The last failed sync, empty when the last sync worked",
            "type": "string"
          },
          "manage": {
            "description": "NebulaCtrl keeps this domain's records in sync",
            "type": "boolean"
          },
          "message": {
            "type": "string"
          },
          "needsAdopt": {
            "type": "boolean"
          },
          "originLock": {
            "$ref": "#/components/schemas/OriginLockView"
          },
          "proxied": {
            "description": "The proxy setting of the domain (orange cloud)",
            "type": "boolean"
          },
          "records": {
            "description": "A, AAAA and CNAME records of the hostname",
            "items": {
              "$ref": "#/components/schemas/RecordView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sslMode": {
            "description": "The zone's SSL/TLS mode; empty when unknown",
            "enum": [
              "",
              "off",
              "flexible",
              "full",
              "strict"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "",
              "managed",
              "present",
              "wrong_target",
              "missing",
              "not_in_zone"
            ],
            "type": "string"
          },
          "tunnel": {
            "description": "The server is behind a Cloudflare Tunnel: the record is a proxied CNAME to it",
            "type": "boolean"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "zoneId": {
            "type": "string"
          },
          "zoneName": {
            "type": "string"
          }
        },
        "required": [
          "configured",
          "status",
          "message",
          "error",
          "zoneId",
          "zoneName",
          "manage",
          "proxied",
          "effectiveProxied",
          "tunnel",
          "needsAdopt",
          "conflict",
          "desired",
          "records",
          "sslMode",
          "warnings",
          "checkedAt",
          "originLock"
        ],
        "type": "object"
      },
      "DailyOutcome": {
        "additionalProperties": false,
        "properties": {
          "date": {
            "description": "UTC day, YYYY-MM-DD",
            "format": "date",
            "type": "string"
          },
          "failed": {
            "description": "failed and rollback_failed",
            "format": "int64",
            "type": "integer"
          },
          "other": {
            "description": "canceled, rolled_back and still in flight",
            "format": "int64",
            "type": "integer"
          },
          "succeeded": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "date",
          "succeeded",
          "failed",
          "other"
        ],
        "type": "object"
      },
      "DailyOutcomes": {
        "additionalProperties": false,
        "properties": {
          "days": {
            "items": {
              "$ref": "#/components/schemas/DailyOutcome"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "days"
        ],
        "type": "object"
      },
      "DashboardAccessView": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "certificate": {
            "$ref": "#/components/schemas/DashboardCertificate"
          },
          "clientIp": {
            "description": "The caller's address as the dashboard route's allow list sees it. Empty when it cannot be determined",
            "type": "string"
          },
          "clientIpAllowed": {
            "description": "The current allow list admits clientIp (always true while it is empty or the caller does not come through the route)",
            "type": "boolean"
          },
          "dnsResolver": {
            "description": "DNS-01 provider of the certificate; empty is automatic HTTP-01",
            "type": "string"
          },
          "enabled": {
            "description": "The dashboard has a system route (an https public URL with a DNS name, installer layout). false: nothing to restrict",
            "type": "boolean"
          },
          "host": {
            "description": "The dashboard's hostname",
            "type": "string"
          },
          "proxyDeployRequired": {
            "type": "boolean"
          },
          "proxyServerId": {
            "description": "The control-plane server, where Deploy proxy lives",
            "type": "string"
          },
          "resolverAvailable": {
            "description": "Providers with a resolver on the control-plane server (Servers, Proxy)",
            "items": {
              "$ref": "#/components/schemas/DashboardResolverOption"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "source": {
            "description": "Where the stored settings come from. installer: seeded from the installer's environment and still overwritten by it on restart; admin: saved here, the installer's environment is ignored",
            "enum": [
              "default",
              "installer",
              "admin"
            ],
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "viaDashboardRoute": {
            "description": "The caller reached the control plane through the dashboard route, so the allow list applies to them",
            "type": "boolean"
          }
        },
        "required": [
          "enabled",
          "host",
          "allowCidrs",
          "dnsResolver",
          "resolverAvailable",
          "certificate",
          "clientIp",
          "clientIpAllowed",
          "viaDashboardRoute",
          "proxyDeployRequired",
          "proxyServerId",
          "source",
          "updatedAt"
        ],
        "type": "object"
      },
      "DashboardCertificate": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "method": {
            "enum": [
              "http-01",
              "dns-01"
            ],
            "type": "string"
          },
          "status": {
            "description": "pending: the DNS-01 resolver is not applied yet, the proxy serves a Let's Encrypt HTTP-01 certificate until Deploy proxy. unknown: the proxy obtains it itself and does not report its state",
            "enum": [
              "pending",
              "unknown"
            ],
            "type": "string"
          }
        },
        "required": [
          "method",
          "status",
          "message"
        ],
        "type": "object"
      },
      "DashboardResolverOption": {
        "additionalProperties": false,
        "properties": {
          "applied": {
            "description": "The proxy runs this resolver. false: it is staged and needs Deploy proxy (Servers, Proxy)",
            "type": "boolean"
          },
          "provider": {
            "description": "The lego provider code, for example cloudflare",
            "type": "string"
          },
          "providerName": {
            "type": "string"
          }
        },
        "required": [
          "provider",
          "providerName",
          "applied"
        ],
        "type": "object"
      },
      "DatabaseView": {
        "additionalProperties": false,
        "properties": {
          "credentialKeys": {
            "description": "Variables that hold credentials; rotate them with the rotate action",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deployed": {
            "type": "boolean"
          },
          "engine": {
            "$ref": "#/components/schemas/EngineView"
          },
          "exports": {
            "items": {
              "$ref": "#/components/schemas/ExportView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "image": {
            "type": "string"
          },
          "info": {
            "$ref": "#/components/schemas/InfoView"
          },
          "replication": {
            "$ref": "#/components/schemas/ReplicationView"
          },
          "rotation": {
            "$ref": "#/components/schemas/RotationView",
            "description": "The latest rotation"
          },
          "serviceId": {
            "type": "string"
          },
          "spec": {
            "$ref": "#/components/schemas/Spec"
          },
          "upgrade": {
            "$ref": "#/components/schemas/UpgradeView",
            "description": "The latest pg_upgrade"
          }
        },
        "required": [
          "serviceId",
          "engine",
          "spec",
          "image",
          "deployed",
          "credentialKeys",
          "exports"
        ],
        "type": "object"
      },
      "DeployHookSetting": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "description": "true turns the hook on (new secret, URL returned once); false turns it off and deletes the secret",
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "DeployHookView": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "image": {
            "type": "string"
          },
          "isProduction": {
            "type": "boolean"
          },
          "lastCalledAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "lastOutcome": {
            "enum": [
              "",
              "deploying",
              "queued",
              "ignored"
            ],
            "type": "string"
          },
          "queued": {
            "type": "boolean"
          },
          "rateLimit": {
            "type": "string"
          },
          "secretSetAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "serviceId": {
            "type": "string"
          },
          "url": {
            "description": "The complete hook URL, shown once when the hook is enabled or rotated; never returned again",
            "type": "string"
          },
          "urlPattern": {
            "description": "The hook URL with \u003csecret\u003e in place of the secret",
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "enabled",
          "urlPattern",
          "secretSetAt",
          "lastCalledAt",
          "lastOutcome",
          "queued",
          "image",
          "isProduction",
          "rateLimit"
        ],
        "type": "object"
      },
      "DeployInputBody": {
        "additionalProperties": false,
        "properties": {
          "reprovision": {
            "description": "Delete the managed node and register it again with a new key",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "DeployInputBody1": {
        "additionalProperties": false,
        "properties": {
          "commitSha": {
            "description": "Git services only: build this full 40-character commit instead of the branch head (\"Rebuild commit\").",
            "type": "string"
          },
          "message": {
            "description": "Optional note shown with the deployment",
            "maxLength": 200,
            "type": "string"
          },
          "noCache": {
            "description": "Git services only: build this one deployment without any cache (--no-cache --pull, and no reuse of an image a build server already pushed). Later deployments build normally. 422 agent_too_old if the server's agent predates this option.",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "DeployKeyLink": {
        "additionalProperties": false,
        "properties": {
          "label": {
            "type": "string"
          },
          "provider": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "provider",
          "label",
          "url"
        ],
        "type": "object"
      },
      "DeployStagedInputBody": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "description": "Optional note shown with every deployment of the batch",
            "maxLength": 200,
            "type": "string"
          },
          "noCache": {
            "description": "Build every git service of the batch without cache (--no-cache --pull) for this batch only; other services deploy as usual",
            "type": "boolean"
          },
          "serviceIds": {
            "description": "Limit to these services (default: every service with staged changes)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "DeploymentMarker": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "sha7": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "at",
          "status"
        ],
        "type": "object"
      },
      "DeploymentRef": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "currentStep": {
            "type": [
              "string",
              "null"
            ]
          },
          "failedStep": {
            "type": [
              "string",
              "null"
            ]
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": [
              "string",
              "null"
            ]
          },
          "releaseId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "strategy": {
            "type": "string"
          },
          "trigger": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "trigger",
          "strategy",
          "statusMessage",
          "createdAt",
          "finishedAt",
          "releaseId",
          "failedStep",
          "currentStep",
          "message"
        ],
        "type": "object"
      },
      "DeploymentView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "actorType": {
            "type": "string"
          },
          "build": {
            "$ref": "#/components/schemas/BuildInfo"
          },
          "buildServerId": {
            "type": "string"
          },
          "buildServerName": {
            "type": "string"
          },
          "cancelRequestedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "cancelRequestedBy": {
            "type": "string"
          },
          "canceledAtStep": {
            "type": "string"
          },
          "commit": {
            "$ref": "#/components/schemas/CommitView"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": [
              "string",
              "null"
            ]
          },
          "noCache": {
            "type": "boolean"
          },
          "release": {
            "$ref": "#/components/schemas/ReleaseView"
          },
          "releaseId": {
            "type": "string"
          },
          "rolledBackFrom": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "strategy": {
            "enum": [
              "rolling",
              "recreate",
              "route_only"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "manual",
              "redeploy",
              "rollback",
              "staged",
              "reconcile",
              "drain",
              "git_push",
              "preview",
              "cron",
              "deploy_hook"
            ],
            "type": "string"
          },
          "waitingFor": {
            "$ref": "#/components/schemas/WaitingFor"
          }
        },
        "required": [
          "id",
          "serviceId",
          "releaseId",
          "serverId",
          "trigger",
          "actorType",
          "actorLabel",
          "status",
          "strategy",
          "statusMessage",
          "rolledBackFrom",
          "generation",
          "createdAt",
          "startedAt",
          "finishedAt",
          "release",
          "message",
          "waitingFor",
          "build",
          "commit",
          "cancelRequestedAt",
          "cancelRequestedBy",
          "canceledAtStep",
          "buildServerId"
        ],
        "type": "object"
      },
      "DestinationListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DestinationView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DestinationView": {
        "additionalProperties": false,
        "properties": {
          "accessKeySet": {
            "type": "boolean"
          },
          "bucket": {
            "type": "string"
          },
          "compatMode": {
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "endpoint": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "inUseBySchedules": {
            "format": "int64",
            "type": "integer"
          },
          "kind": {
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "lastTestAt": {
            "format": "date-time",
            "type": "string"
          },
          "lastTestMessage": {
            "type": "string"
          },
          "lastTestOk": {
            "type": "boolean"
          },
          "localDir": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "offSite": {
            "description": "False for local directories: a backup on the database's own host does not survive the loss of that host.",
            "type": "boolean"
          },
          "pathStyle": {
            "type": "boolean"
          },
          "prefix": {
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "secretKeySet": {
            "type": "boolean"
          },
          "storedBackups": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "pathStyle",
          "compatMode",
          "accessKeySet",
          "secretKeySet",
          "offSite",
          "createdAt",
          "inUseBySchedules",
          "storedBackups"
        ],
        "type": "object"
      },
      "DeviceMapping": {
        "additionalProperties": false,
        "properties": {
          "containerPath": {
            "type": "string"
          },
          "hostPath": {
            "type": "string"
          },
          "permissions": {
            "type": "string"
          }
        },
        "required": [
          "hostPath"
        ],
        "type": "object"
      },
      "DevicesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TailscaleDevice"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DevicesView": {
        "additionalProperties": false,
        "properties": {
          "used": {
            "description": "Tagged devices the mesh uses: one per server node and one per link node",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "used"
        ],
        "type": "object"
      },
      "DnsFixInputBody": {
        "additionalProperties": false,
        "properties": {
          "adopt": {
            "description": "Take over the existing record NebulaCtrl did not create: it is marked as managed and pointed at the server",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "DnsSettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "manage": {
            "description": "Let NebulaCtrl keep the domain's DNS records in sync",
            "type": "boolean"
          },
          "originLock": {
            "description": "Lock the origin to Cloudflare while the domain is proxied (default true). False opts out: anyone who finds the server's IP can bypass Cloudflare. Audited.",
            "type": "boolean"
          },
          "proxied": {
            "description": "Proxy through Cloudflare (orange cloud). Tunnel records are always proxied.",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "DockerBlock": {
        "additionalProperties": false,
        "properties": {
          "apparmorUnconfined": {
            "type": "boolean"
          },
          "capAdd": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "capDrop": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "devices": {
            "items": {
              "$ref": "#/components/schemas/DeviceMapping"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "dns": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "entrypoint": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "extraHosts": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "gpus": {
            "$ref": "#/components/schemas/GPURequest"
          },
          "groupAdd": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostSysctls": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "type": "object"
          },
          "hostname": {
            "type": "string"
          },
          "init": {
            "type": "boolean"
          },
          "labels": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "noNewPrivileges": {
            "type": "boolean"
          },
          "pidHost": {
            "type": "boolean"
          },
          "pidsLimit": {
            "format": "int64",
            "type": "integer"
          },
          "privileged": {
            "type": "boolean"
          },
          "readOnlyRootfs": {
            "type": "boolean"
          },
          "runtime": {
            "type": "string"
          },
          "seccompUnconfined": {
            "type": "boolean"
          },
          "shmSizeMb": {
            "format": "int64",
            "type": "integer"
          },
          "stopSignal": {
            "type": "string"
          },
          "sysctls": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "tmpfs": {
            "items": {
              "$ref": "#/components/schemas/TmpfsMount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ulimits": {
            "items": {
              "$ref": "#/components/schemas/Ulimit"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "user": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "DockerOptions": {
        "additionalProperties": false,
        "properties": {
          "apparmorUnconfined": {
            "type": "boolean"
          },
          "capAdd": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "capDrop": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "devices": {
            "items": {
              "$ref": "#/components/schemas/DeviceMapping"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "dns": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "entrypoint": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "extraHosts": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "gpus": {
            "$ref": "#/components/schemas/GPURequest"
          },
          "groupAdd": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostSysctls": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "type": "object"
          },
          "hostname": {
            "type": "string"
          },
          "init": {
            "type": "boolean"
          },
          "labels": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "noNewPrivileges": {
            "type": "boolean"
          },
          "pidHost": {
            "type": "boolean"
          },
          "pidsLimit": {
            "format": "int64",
            "type": "integer"
          },
          "privileged": {
            "type": "boolean"
          },
          "readOnlyRootfs": {
            "type": "boolean"
          },
          "runtime": {
            "type": "string"
          },
          "seccompUnconfined": {
            "type": "boolean"
          },
          "shmSizeMb": {
            "format": "int64",
            "type": "integer"
          },
          "stopSignal": {
            "type": "string"
          },
          "sysctls": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "tmpfs": {
            "items": {
              "$ref": "#/components/schemas/TmpfsMount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ulimits": {
            "items": {
              "$ref": "#/components/schemas/Ulimit"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "user": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "DockerOptionsCatalog": {
        "additionalProperties": false,
        "properties": {
          "allowedSysctls": {
            "description": "Container sysctls (IPC and network namespaced) a service may set",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "gpuCapabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostSysctlKeys": {
            "description": "Host kernel parameters a service may declare as requirements (hostSysctls)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "knownCapabilities": {
            "description": "Capability names capDrop accepts besides ALL",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "reservedLabels": {
            "description": "Label prefixes services cannot set",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "safeCapabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "stopSignals": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "unrestrictedCapabilities": {
            "description": "Capabilities that need an unrestricted server",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "unrestrictedFields": {
            "description": "Options that work only on an unrestricted server",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnCapabilities": {
            "description": "Safe-listed capabilities the UI warns about",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "safeCapabilities",
          "warnCapabilities",
          "unrestrictedCapabilities",
          "knownCapabilities",
          "allowedSysctls",
          "hostSysctlKeys",
          "gpuCapabilities",
          "reservedLabels",
          "stopSignals",
          "unrestrictedFields"
        ],
        "type": "object"
      },
      "DomainCert": {
        "additionalProperties": false,
        "properties": {
          "daysToExpiry": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "issuer": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "notAfter": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "resolver": {
            "description": "DNS-01 provider, for sources wildcard and dns01",
            "type": "string"
          },
          "source": {
            "enum": [
              "wildcard",
              "dns01",
              "acme",
              "custom",
              "none"
            ],
            "type": "string"
          },
          "status": {
            "description": "unknown: this source's certificate is not observed (HTTP-01 and uploaded certificates)",
            "enum": [
              "pending",
              "active",
              "error",
              "unknown"
            ],
            "type": "string"
          },
          "warning": {
            "description": "Why the certificate cannot be issued as configured (HTTP-01 on a proxy that does not listen on port 80); empty when there is none",
            "type": "string"
          },
          "wildcard": {
            "description": "The covering wildcard name, e.g. *.example.com",
            "type": "string"
          },
          "wildcardId": {
            "type": "string"
          }
        },
        "required": [
          "source",
          "status",
          "message",
          "resolver",
          "wildcard",
          "wildcardId",
          "issuer",
          "notAfter",
          "daysToExpiry",
          "warning"
        ],
        "type": "object"
      },
      "DomainDNS": {
        "additionalProperties": false,
        "properties": {
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "error": {
            "description": "The last failed sync, empty when the last sync worked",
            "type": "string"
          },
          "manage": {
            "type": "boolean"
          },
          "message": {
            "type": "string"
          },
          "provider": {
            "enum": [
              "cloudflare"
            ],
            "type": "string"
          },
          "proxied": {
            "description": "Orange cloud: traffic goes through Cloudflare. Tunnel records are always proxied.",
            "type": "boolean"
          },
          "status": {
            "enum": [
              "",
              "managed",
              "present",
              "wrong_target",
              "missing",
              "not_in_zone"
            ],
            "type": "string"
          },
          "zoneId": {
            "type": "string"
          },
          "zoneName": {
            "type": "string"
          }
        },
        "required": [
          "provider",
          "zoneId",
          "zoneName",
          "manage",
          "proxied",
          "status",
          "message",
          "error",
          "checkedAt"
        ],
        "type": "object"
      },
      "DomainInput": {
        "additionalProperties": false,
        "properties": {
          "hostname": {
            "maxLength": 253,
            "minLength": 3,
            "type": "string"
          }
        },
        "required": [
          "hostname"
        ],
        "type": "object"
      },
      "DomainView": {
        "additionalProperties": false,
        "properties": {
          "addPrefix": {
            "type": "string"
          },
          "authUsers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "cert": {
            "$ref": "#/components/schemas/DomainCert"
          },
          "certificateId": {
            "type": "string"
          },
          "component": {
            "type": "string"
          },
          "dns": {
            "$ref": "#/components/schemas/DomainDNS"
          },
          "dnsCheckedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "dnsOk": {
            "type": [
              "boolean",
              "null"
            ]
          },
          "dnsResolver": {
            "description": "The lego code of the DNS-01 provider that obtains the certificate; empty = HTTP-01 or a covering wildcard certificate",
            "type": "string"
          },
          "generated": {
            "type": "boolean"
          },
          "hostname": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "serve",
              "redirect"
            ],
            "type": "string"
          },
          "options": {
            "$ref": "#/components/schemas/RouteOptions"
          },
          "pathPrefix": {
            "type": "string"
          },
          "preservePath": {
            "type": "boolean"
          },
          "redirectCode": {
            "enum": [
              301,
              302,
              307,
              308
            ],
            "format": "int64",
            "type": "integer"
          },
          "redirectTo": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "stripPrefix": {
            "type": "boolean"
          },
          "targetPort": {
            "format": "int64",
            "type": "integer"
          },
          "tlsMode": {
            "enum": [
              "auto",
              "custom",
              "none"
            ],
            "type": "string"
          },
          "wwwPartner": {
            "description": "The counterpart hostname a www redirect would use (www.\u003chost\u003e, or the host without www.); empty when the domain cannot have one",
            "type": "string"
          },
          "wwwRedirect": {
            "description": "A whole-host redirect from wwwPartner to this domain exists (both hostnames are routed and get certificates)",
            "type": "boolean"
          },
          "wwwRedirectFor": {
            "description": "For the redirect domain of a www redirect: the hostname it redirects to; empty otherwise",
            "type": "string"
          }
        },
        "required": [
          "id",
          "hostname",
          "targetPort",
          "component",
          "generated",
          "status",
          "statusMessage",
          "dnsOk",
          "dnsCheckedAt",
          "pathPrefix",
          "stripPrefix",
          "addPrefix",
          "kind",
          "redirectTo",
          "redirectCode",
          "preservePath",
          "tlsMode",
          "certificateId",
          "options",
          "authUsers",
          "dnsResolver",
          "cert",
          "dns",
          "wwwPartner",
          "wwwRedirect",
          "wwwRedirectFor"
        ],
        "type": "object"
      },
      "DrainConfigBody": {
        "additionalProperties": false,
        "properties": {
          "http": {
            "$ref": "#/components/schemas/HTTPDrainConfig",
            "description": "Generic HTTP JSON batches (Datadog, Better Stack, Axiom intakes, your own endpoint)."
          },
          "loki": {
            "$ref": "#/components/schemas/LokiDrainConfig",
            "description": "Loki push API: url (the full /loki/api/v1/push URL), tenantId, static labels."
          },
          "otlp": {
            "$ref": "#/components/schemas/OTLPDrainConfig",
            "description": "OTLP/HTTP logs: url (the full /v1/logs URL), resource attributes."
          },
          "syslog": {
            "$ref": "#/components/schemas/SyslogDrainConfig",
            "description": "RFC 5424 syslog: address host:port, protocol udp, tcp or tcp+tls."
          }
        },
        "type": "object"
      },
      "DrainListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/LogDrainView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DrainPlan": {
        "additionalProperties": false,
        "properties": {
          "capacity": {
            "$ref": "#/components/schemas/Capacity"
          },
          "moves": {
            "items": {
              "$ref": "#/components/schemas/PlanMove"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "moves",
          "capacity"
        ],
        "type": "object"
      },
      "DrainView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "cancelRequested": {
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "moves": {
            "items": {
              "$ref": "#/components/schemas/Move"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "serverId": {
            "type": "string"
          },
          "state": {
            "enum": [
              "running",
              "completed",
              "failed",
              "canceled"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "serverId",
          "state",
          "message",
          "cancelRequested",
          "actorLabel",
          "moves",
          "createdAt",
          "finishedAt"
        ],
        "type": "object"
      },
      "DumpRestoreListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DumpRestoreView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "DumpRestoreView": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "bytesReceived": {
            "description": "Bytes the agent has accepted so far.",
            "format": "int64",
            "type": "integer"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "fileName": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "format": {
            "description": "Detected from the file's first bytes: pg_custom, pg_tar, sql or mongo_archive.",
            "type": "string"
          },
          "gzip": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "log": {
            "description": "Progress of the restore (the newest 64 KiB), one line per entry. Omitted from lists.",
            "type": "string"
          },
          "maxUploadBytes": {
            "description": "The largest file the control plane accepts.",
            "format": "int64",
            "type": "integer"
          },
          "mode": {
            "enum": [
              "new",
              "in_place"
            ],
            "type": "string"
          },
          "preBackupId": {
            "type": "string"
          },
          "sha256": {
            "description": "Checksum of the uploaded bytes, known once the upload completed.",
            "type": "string"
          },
          "sizeBytes": {
            "description": "Bytes announced by the upload.",
            "format": "int64",
            "type": "integer"
          },
          "sourceServiceId": {
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "provisioning",
              "pre_backup",
              "awaiting_upload",
              "uploading",
              "restoring",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "targetServiceId": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "mode",
          "sourceServiceId",
          "status",
          "sizeBytes",
          "bytesReceived",
          "maxUploadBytes",
          "createdAt"
        ],
        "type": "object"
      },
      "EngineView": {
        "additionalProperties": false,
        "properties": {
          "category": {
            "enum": [
              "relational",
              "keyvalue",
              "document",
              "analytics"
            ],
            "type": "string"
          },
          "default": {
            "description": "The preselected engine of its category",
            "type": "boolean"
          },
          "description": {
            "type": "string"
          },
          "flavors": {
            "items": {
              "$ref": "#/components/schemas/FlavorView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "license": {
            "type": "string"
          },
          "licenseClass": {
            "enum": [
              "permissive",
              "copyleft",
              "source-available"
            ],
            "type": "string"
          },
          "licenseNote": {
            "type": "string"
          },
          "optIn": {
            "description": "Creation needs acceptLicense=true",
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "rotation": {
            "enum": [
              "exec",
              "redeploy"
            ],
            "type": "string"
          },
          "versions": {
            "items": {
              "$ref": "#/components/schemas/VersionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "label",
          "description",
          "category",
          "port",
          "default",
          "optIn",
          "license",
          "licenseClass",
          "rotation",
          "versions",
          "flavors"
        ],
        "type": "object"
      },
      "EnrollmentToken": {
        "additionalProperties": false,
        "properties": {
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "installCommand": {
            "type": "string"
          },
          "server": {
            "$ref": "#/components/schemas/Server"
          },
          "token": {
            "description": "Shown once; only its hash is stored",
            "type": "string"
          }
        },
        "required": [
          "server",
          "token",
          "expiresAt",
          "installCommand"
        ],
        "type": "object"
      },
      "EnvDeploymentView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "actorType": {
            "type": "string"
          },
          "build": {
            "$ref": "#/components/schemas/BuildInfo"
          },
          "buildServerId": {
            "type": "string"
          },
          "buildServerName": {
            "type": "string"
          },
          "cancelRequestedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "cancelRequestedBy": {
            "type": "string"
          },
          "canceledAtStep": {
            "type": "string"
          },
          "commit": {
            "$ref": "#/components/schemas/CommitView"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": [
              "string",
              "null"
            ]
          },
          "noCache": {
            "type": "boolean"
          },
          "release": {
            "$ref": "#/components/schemas/ReleaseView"
          },
          "releaseId": {
            "type": "string"
          },
          "rolledBackFrom": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "serviceSlug": {
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "strategy": {
            "enum": [
              "rolling",
              "recreate",
              "route_only"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "manual",
              "redeploy",
              "rollback",
              "staged",
              "reconcile",
              "drain",
              "git_push",
              "preview",
              "cron",
              "deploy_hook"
            ],
            "type": "string"
          },
          "waitingFor": {
            "$ref": "#/components/schemas/WaitingFor"
          }
        },
        "required": [
          "serviceName",
          "serviceSlug",
          "id",
          "serviceId",
          "releaseId",
          "serverId",
          "trigger",
          "actorType",
          "actorLabel",
          "status",
          "strategy",
          "statusMessage",
          "rolledBackFrom",
          "generation",
          "createdAt",
          "startedAt",
          "finishedAt",
          "release",
          "message",
          "waitingFor",
          "build",
          "commit",
          "cancelRequestedAt",
          "cancelRequestedBy",
          "canceledAtStep",
          "buildServerId"
        ],
        "type": "object"
      },
      "EnvGrantView": {
        "additionalProperties": false,
        "properties": {
          "consumerId": {
            "type": "string"
          },
          "consumerSlug": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "exposureId": {
            "type": "string"
          },
          "linkId": {
            "type": "string"
          },
          "meshPort": {
            "format": "int64",
            "type": "integer"
          },
          "providerId": {
            "type": "string"
          },
          "providerSlug": {
            "type": "string"
          },
          "source": {
            "enum": [
              "reference",
              "edge",
              "replica"
            ],
            "type": "string"
          }
        },
        "required": [
          "linkId",
          "exposureId",
          "consumerId",
          "consumerSlug",
          "providerId",
          "providerSlug",
          "source",
          "meshPort",
          "createdAt"
        ],
        "type": "object"
      },
      "EnvLinkView": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "$ref": "#/components/schemas/MeshServerRef",
            "description": "The consumer's server: the link node runs here"
          },
          "grants": {
            "items": {
              "$ref": "#/components/schemas/EnvGrantView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "purpose": {
            "enum": [
              "service",
              "replication"
            ],
            "type": "string"
          },
          "state": {
            "type": "string"
          },
          "to": {
            "$ref": "#/components/schemas/MeshServerRef",
            "description": "The provider's server"
          }
        },
        "required": [
          "id",
          "from",
          "to",
          "purpose",
          "state",
          "message",
          "grants"
        ],
        "type": "object"
      },
      "EnvTemplateFile": {
        "additionalProperties": false,
        "properties": {
          "keys": {
            "description": "Variables the file lists",
            "format": "int64",
            "type": "integer"
          },
          "path": {
            "type": "string"
          }
        },
        "required": [
          "path",
          "keys"
        ],
        "type": "object"
      },
      "EnvTemplatePreviewInput": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "description": "Defaults to the repository's default branch",
            "type": "string"
          },
          "buildContext": {
            "description": "Build context directory, read as well as the repository root",
            "type": "string"
          },
          "connectionId": {
            "description": "Git connection the repository is read through",
            "type": "string"
          },
          "gitToken": {
            "description": "Access token of a private repository, used for this read only and never stored",
            "type": "string"
          },
          "gitUrl": {
            "description": "Clone URL of the repository (https, public or with gitToken)",
            "type": "string"
          },
          "repo": {
            "description": "owner/name on the connection",
            "type": "string"
          },
          "serverId": {
            "description": "The server a read that needs an agent runs on",
            "type": "string"
          }
        },
        "type": "object"
      },
      "EnvTemplateScan": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "type": "string"
          },
          "commit": {
            "description": "Commit the files were read from (agent reads only)",
            "type": "string"
          },
          "files": {
            "items": {
              "$ref": "#/components/schemas/EnvTemplateFile"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "items": {
            "description": "One suggestion per key not set yet, with smart defaults (database references, generators, safe example values)",
            "items": {
              "$ref": "#/components/schemas/SuggestedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "method": {
            "description": "provider: read through the git provider's API; agent: read on the server",
            "enum": [
              "provider",
              "agent",
              "none"
            ],
            "type": "string"
          },
          "skipped": {
            "items": {
              "$ref": "#/components/schemas/SkippedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "status": {
            "description": "found: files with keys exist; none: the repository has no template file; unavailable: it could not be read (see message)",
            "enum": [
              "found",
              "none",
              "unavailable"
            ],
            "type": "string"
          }
        },
        "required": [
          "status",
          "method",
          "message",
          "files",
          "items",
          "skipped"
        ],
        "type": "object"
      },
      "Environment": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "isProduction": {
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "standard",
              "preview"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "parentEnvironmentId": {
            "type": [
              "string",
              "null"
            ]
          },
          "prNumber": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "prTitle": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "projectId",
          "name",
          "slug",
          "isProduction",
          "createdAt",
          "kind",
          "parentEnvironmentId",
          "prNumber",
          "prTitle"
        ],
        "type": "object"
      },
      "EnvironmentMeshView": {
        "additionalProperties": false,
        "properties": {
          "grants": {
            "items": {
              "$ref": "#/components/schemas/EnvGrantView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "links": {
            "items": {
              "$ref": "#/components/schemas/EnvLinkView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "routes": {
            "items": {
              "$ref": "#/components/schemas/RouteView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "links",
          "grants",
          "routes"
        ],
        "type": "object"
      },
      "Error": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "Stable machine-readable error code",
            "examples": [
              "not_found"
            ],
            "type": "string"
          },
          "detail": {
            "description": "Human-readable explanation",
            "type": "string"
          },
          "details": {
            "additionalProperties": {},
            "description": "Additional structured context",
            "type": "object"
          },
          "errors": {
            "description": "Field-level validation errors",
            "items": {
              "$ref": "#/components/schemas/ErrorDetail"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "status": {
            "description": "HTTP status code",
            "examples": [
              404
            ],
            "format": "int64",
            "type": "integer"
          },
          "title": {
            "description": "Short summary of the problem type",
            "examples": [
              "Not Found"
            ],
            "type": "string"
          },
          "type": {
            "description": "A URI reference identifying the problem type",
            "examples": [
              "about:blank"
            ],
            "type": "string"
          }
        },
        "required": [
          "status",
          "code"
        ],
        "type": "object"
      },
      "ErrorDetail": {
        "additionalProperties": false,
        "properties": {
          "location": {
            "description": "Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'",
            "type": "string"
          },
          "message": {
            "description": "Error message text",
            "type": "string"
          },
          "value": {
            "description": "The value at the given location"
          }
        },
        "type": "object"
      },
      "EventTypesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ChannelEventType"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "EventView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "message": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "step": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "step",
          "status",
          "message",
          "createdAt"
        ],
        "type": "object"
      },
      "EventsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/EventView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ExportVar": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "description",
          "secret"
        ],
        "type": "object"
      },
      "ExportView": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "primary": {
            "type": "boolean"
          },
          "reference": {
            "description": "How other services reference it",
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "description",
          "secret",
          "primary",
          "reference"
        ],
        "type": "object"
      },
      "ExposureView": {
        "additionalProperties": false,
        "properties": {
          "alias": {
            "type": "string"
          },
          "containerPort": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "meshPort": {
            "format": "int64",
            "type": "integer"
          },
          "purpose": {
            "enum": [
              "service",
              "replication"
            ],
            "type": "string"
          },
          "server": {
            "$ref": "#/components/schemas/MeshServerRef"
          }
        },
        "required": [
          "id",
          "server",
          "purpose",
          "containerPort",
          "meshPort",
          "alias"
        ],
        "type": "object"
      },
      "Facts": {
        "additionalProperties": false,
        "properties": {
          "agentUpgrade": {
            "$ref": "#/components/schemas/UpgradeReport"
          },
          "arch": {
            "type": "string"
          },
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "cgroupVersion": {
            "type": "string"
          },
          "composeVersion": {
            "type": "string"
          },
          "cpus": {
            "format": "int64",
            "type": "integer"
          },
          "diskTotal": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "dockerVersion": {
            "type": "string"
          },
          "emulation": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostSysctls": {
            "additionalProperties": {
              "format": "int64",
              "type": "integer"
            },
            "type": "object"
          },
          "hostTailscale": {
            "$ref": "#/components/schemas/HostTailscale"
          },
          "kernel": {
            "type": "string"
          },
          "memTotal": {
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "os": {
            "type": "string"
          },
          "port443Free": {
            "type": "boolean"
          },
          "port80Free": {
            "type": "boolean"
          },
          "tunDevice": {
            "type": "boolean"
          }
        },
        "required": [
          "os",
          "arch",
          "kernel",
          "cpus",
          "memTotal",
          "diskTotal",
          "dockerVersion",
          "cgroupVersion",
          "port80Free",
          "port443Free"
        ],
        "type": "object"
      },
      "FieldChange": {
        "additionalProperties": false,
        "properties": {
          "field": {
            "type": "string"
          },
          "from": {
            "type": "string"
          },
          "origin": {
            "type": "string"
          },
          "resolvedChanged": {
            "type": "boolean"
          },
          "to": {
            "type": "string"
          },
          "via": {
            "type": "string"
          }
        },
        "required": [
          "field",
          "from",
          "to"
        ],
        "type": "object"
      },
      "FileEntry": {
        "additionalProperties": false,
        "properties": {
          "linkTarget": {
            "type": "string"
          },
          "mode": {
            "description": "Octal permission bits, e.g. 0755.",
            "type": "string"
          },
          "modifiedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "size": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "enum": [
              "file",
              "dir",
              "link",
              "other"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "size"
        ],
        "type": "object"
      },
      "FileListing": {
        "additionalProperties": false,
        "properties": {
          "entries": {
            "items": {
              "$ref": "#/components/schemas/FileEntry"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "path": {
            "description": "The resolved directory path.",
            "type": "string"
          },
          "readOnlyReason": {
            "type": "string"
          },
          "replica": {
            "format": "int64",
            "type": "integer"
          },
          "truncated": {
            "description": "The directory has more entries than are listed.",
            "type": "boolean"
          },
          "writable": {
            "description": "Uploads are allowed here.",
            "type": "boolean"
          }
        },
        "required": [
          "path",
          "replica",
          "entries",
          "truncated",
          "writable"
        ],
        "type": "object"
      },
      "FileMount": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "type": "string"
          },
          "mode": {
            "type": "string"
          },
          "path": {
            "type": "string"
          }
        },
        "required": [
          "path",
          "content"
        ],
        "type": "object"
      },
      "FileWritePolicy": {
        "additionalProperties": false,
        "properties": {
          "allowed": {
            "type": "boolean"
          },
          "reason": {
            "description": "Why writes are off (production services are read-only unless an admin allows writes for the project).",
            "type": "string"
          }
        },
        "required": [
          "allowed"
        ],
        "type": "object"
      },
      "FixesInputBody": {
        "additionalProperties": false,
        "properties": {
          "fixIds": {
            "description": "The fixes to apply or undo. Apply with none selects the default set (the ones marked default in the fix list); rollback needs at least one.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "FlavorView": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "note": {
            "type": "string"
          },
          "versions": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "label",
          "versions"
        ],
        "type": "object"
      },
      "FleetInputBody": {
        "additionalProperties": false,
        "properties": {
          "force": {
            "description": "Install a version an agent rolled back before.",
            "type": "boolean"
          },
          "serverIds": {
            "description": "The servers to upgrade. Empty: every server whose agent can be upgraded now.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "FleetServer": {
        "additionalProperties": false,
        "properties": {
          "committedMemBytes": {
            "description": "Sum of the memory limits of the services placed on the server",
            "format": "int64",
            "type": "integer"
          },
          "cpuPercent": {
            "format": "double",
            "type": "number"
          },
          "cpus": {
            "format": "int64",
            "type": "integer"
          },
          "diskTotalBytes": {
            "format": "int64",
            "type": "integer"
          },
          "diskUsedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "drainMessage": {
            "type": "string"
          },
          "drainState": {
            "enum": [
              "none",
              "draining",
              "drained",
              "failed"
            ],
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "memTotalBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memUsedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "overcommitted": {
            "description": "Committed limits exceed the host's memory",
            "type": "boolean"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/FleetService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "status": {
            "enum": [
              "pending",
              "online",
              "offline",
              "revoked"
            ],
            "type": "string"
          },
          "unlimitedServices": {
            "description": "Services on the server without a memory limit",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "drainState",
          "drainMessage",
          "cpus",
          "memTotalBytes",
          "diskTotalBytes",
          "cpuPercent",
          "memUsedBytes",
          "diskUsedBytes",
          "committedMemBytes",
          "unlimitedServices",
          "overcommitted",
          "services"
        ],
        "type": "object"
      },
      "FleetService": {
        "additionalProperties": false,
        "properties": {
          "cpuPercent": {
            "format": "double",
            "type": "number"
          },
          "environmentId": {
            "type": "string"
          },
          "environmentName": {
            "type": "string"
          },
          "environmentSlug": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "app",
              "worker",
              "database"
            ],
            "type": "string"
          },
          "memBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memLimitBytes": {
            "description": "Configured memory limit, 0 when unlimited",
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "projectName": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "stateful": {
            "type": "boolean"
          },
          "status": {
            "description": "Latest deployment while one is active or failed, otherwise the observed container state",
            "enum": [
              "undeployed",
              "deploying",
              "running",
              "unhealthy",
              "stopped",
              "missing",
              "failed",
              "unknown"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "projectId",
          "projectName",
          "environmentId",
          "environmentName",
          "environmentSlug",
          "kind",
          "status",
          "cpuPercent",
          "memBytes",
          "memLimitBytes",
          "stateful"
        ],
        "type": "object"
      },
      "FleetTotals": {
        "additionalProperties": false,
        "properties": {
          "committedMemBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memTotalBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memUsedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "servers": {
            "format": "int64",
            "type": "integer"
          },
          "services": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "servers",
          "services",
          "memTotalBytes",
          "memUsedBytes",
          "committedMemBytes"
        ],
        "type": "object"
      },
      "GPURequest": {
        "additionalProperties": false,
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "count": {
            "format": "int64",
            "type": "integer"
          },
          "driver": {
            "enum": [
              "nvidia"
            ],
            "type": "string"
          }
        },
        "required": [
          "count",
          "driver"
        ],
        "type": "object"
      },
      "GeneratorCall": {
        "additionalProperties": false,
        "properties": {
          "args": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "fn": {
            "type": "string"
          }
        },
        "required": [
          "fn",
          "args"
        ],
        "type": "object"
      },
      "Geo": {
        "additionalProperties": false,
        "properties": {
          "attribution": {
            "description": "Credit to show next to the data (one entry per source in use)",
            "items": {
              "$ref": "#/components/schemas/GeoAttribution"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "cities": {
            "items": {
              "$ref": "#/components/schemas/GeoCity"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "countries": {
            "items": {
              "$ref": "#/components/schemas/GeoCountry"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "level": {
            "description": "city when any server in scope counts cities",
            "enum": [
              "country",
              "city"
            ],
            "type": "string"
          },
          "locatedRequests": {
            "format": "int64",
            "type": "integer"
          },
          "source": {
            "enum": [
              "dbip",
              "maxmind",
              "mixed"
            ],
            "type": "string"
          },
          "unknownRequests": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "level",
          "source",
          "attribution",
          "locatedRequests",
          "unknownRequests",
          "countries",
          "cities"
        ],
        "type": "object"
      },
      "GeoAttribution": {
        "additionalProperties": false,
        "properties": {
          "source": {
            "enum": [
              "dbip",
              "maxmind"
            ],
            "type": "string"
          },
          "text": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "source",
          "text",
          "url"
        ],
        "type": "object"
      },
      "GeoCity": {
        "additionalProperties": false,
        "properties": {
          "country": {
            "description": "ISO 3166-1 alpha-2 code",
            "type": "string"
          },
          "lat": {
            "description": "Rounded to 0.1°",
            "format": "double",
            "type": "number"
          },
          "lon": {
            "description": "Rounded to 0.1°",
            "format": "double",
            "type": "number"
          },
          "name": {
            "type": "string"
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          },
          "share": {
            "description": "Fraction (0-1) of the located requests",
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "name",
          "country",
          "lat",
          "lon",
          "requests",
          "share"
        ],
        "type": "object"
      },
      "GeoCountry": {
        "additionalProperties": false,
        "properties": {
          "iso2": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          },
          "share": {
            "description": "Fraction (0-1) of the located requests",
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "iso2",
          "name",
          "requests",
          "share"
        ],
        "type": "object"
      },
      "GeoCredentialsStatus": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "description": "MaxMind account ID; empty when none is stored",
            "type": "string"
          },
          "configured": {
            "type": "boolean"
          },
          "serversUsing": {
            "format": "int64",
            "type": "integer"
          },
          "updatedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "configured",
          "accountId",
          "updatedAt",
          "serversUsing"
        ],
        "type": "object"
      },
      "GetDrainOutputBody": {
        "additionalProperties": false,
        "properties": {
          "drain": {
            "$ref": "#/components/schemas/DrainView",
            "description": "The running drain, else the newest finished one; null when the server was never drained"
          }
        },
        "required": [
          "drain"
        ],
        "type": "object"
      },
      "GitHubAppView": {
        "additionalProperties": false,
        "properties": {
          "appId": {
            "format": "int64",
            "type": "integer"
          },
          "appSlug": {
            "type": "string"
          },
          "appUrl": {
            "type": "string"
          },
          "installUrl": {
            "type": "string"
          },
          "installationId": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "appSlug",
          "appId",
          "installationId",
          "appUrl",
          "installUrl"
        ],
        "type": "object"
      },
      "GitLinkView": {
        "additionalProperties": false,
        "properties": {
          "autoDeploy": {
            "type": "boolean"
          },
          "branch": {
            "type": "string"
          },
          "connectionId": {
            "type": "string"
          },
          "connectionName": {
            "type": "string"
          },
          "linked": {
            "type": "boolean"
          },
          "provider": {
            "enum": [
              "github",
              "gitlab",
              "gitea",
              "forgejo",
              "bitbucket"
            ],
            "type": "string"
          },
          "queuedCommit": {
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "repoUrl": {
            "type": "string"
          },
          "watchPaths": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "webhook": {
            "$ref": "#/components/schemas/HookStatusView"
          }
        },
        "required": [
          "linked",
          "connectionId",
          "connectionName",
          "repo",
          "repoUrl",
          "branch",
          "autoDeploy",
          "watchPaths",
          "webhook",
          "queuedCommit"
        ],
        "type": "object"
      },
      "GitRef": {
        "additionalProperties": false,
        "properties": {
          "autoDeploy": {
            "type": "boolean"
          },
          "connectionId": {
            "type": "string"
          },
          "connectionName": {
            "type": "string"
          },
          "provider": {
            "enum": [
              "github",
              "gitlab",
              "gitea",
              "forgejo",
              "bitbucket"
            ],
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "watchPaths": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "connectionId",
          "provider",
          "connectionName",
          "repo",
          "autoDeploy",
          "watchPaths"
        ],
        "type": "object"
      },
      "GrantChange": {
        "additionalProperties": false,
        "properties": {
          "consumer": {
            "type": "string"
          },
          "provider": {
            "type": "string"
          },
          "source": {
            "type": "string"
          }
        },
        "required": [
          "consumer",
          "provider",
          "source"
        ],
        "type": "object"
      },
      "Group": {
        "additionalProperties": false,
        "properties": {
          "collapsed": {
            "type": "boolean"
          },
          "h": {
            "format": "double",
            "type": "number"
          },
          "id": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "name": {
            "maxLength": 200,
            "type": "string"
          },
          "serviceIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "w": {
            "format": "double",
            "type": "number"
          },
          "x": {
            "format": "double",
            "type": "number"
          },
          "y": {
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "id",
          "name",
          "x",
          "y",
          "w",
          "h",
          "collapsed",
          "serviceIds"
        ],
        "type": "object"
      },
      "HTTPDrainConfig": {
        "additionalProperties": false,
        "properties": {
          "extraFields": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "format": {
            "type": "string"
          },
          "messageField": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "timestampField": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "HardeningFix": {
        "additionalProperties": false,
        "properties": {
          "default": {
            "description": "Part of Apply safe fixes; the others are applied one by one",
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "lynisTests": {
            "description": "The Lynis test IDs the fix answers",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "manual": {
            "description": "What to type to do the same by hand",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "message": {
            "type": "string"
          },
          "rebootRequired": {
            "description": "Takes effect after the next reboot",
            "type": "boolean"
          },
          "risk": {
            "description": "The honest downside",
            "type": "string"
          },
          "state": {
            "description": "applied: NebulaCtrl applied it. compliant: the host already satisfies it. pending: it would change something. unavailable: it does not apply here (the message says why). unknown: no audit has reported yet",
            "enum": [
              "applied",
              "compliant",
              "pending",
              "unavailable",
              "unknown"
            ],
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "why": {
            "description": "What the fix changes and why",
            "type": "string"
          }
        },
        "required": [
          "id",
          "title",
          "why",
          "risk",
          "default",
          "rebootRequired",
          "lynisTests",
          "state",
          "manual"
        ],
        "type": "object"
      },
      "HardeningFixOutcome": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "outcome": {
            "enum": [
              "applied",
              "unchanged",
              "skipped",
              "failed",
              "rolled_back"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "outcome"
        ],
        "type": "object"
      },
      "HardeningRemaining": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "fixId": {
            "description": "The safe fix that answers it, when there is one",
            "type": "string"
          },
          "fixMessage": {
            "type": "string"
          },
          "fixState": {
            "type": "string"
          },
          "link": {
            "description": "CISOfy's page for the Lynis control",
            "type": "string"
          },
          "manual": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "never": {
            "description": "Set when NebulaCtrl deliberately never changes this, and why",
            "type": "string"
          },
          "severity": {
            "enum": [
              "warning",
              "suggestion"
            ],
            "type": "string"
          },
          "testId": {
            "type": "string"
          },
          "title": {
            "type": "string"
          }
        },
        "required": [
          "testId",
          "severity",
          "title",
          "manual",
          "link"
        ],
        "type": "object"
      },
      "HardeningRun": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "audit",
              "apply",
              "rollback"
            ],
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "fixIds": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "hardeningIndex": {
            "description": "The hardening index the run measured; null when it did not audit",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "indexBefore": {
            "description": "The hardening index before the run; null when there was no audit yet",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "lynisVersion": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "outcomes": {
            "description": "What an apply or rollback did, per fix",
            "items": {
              "$ref": "#/components/schemas/HardeningFixOutcome"
            },
            "type": "array"
          },
          "status": {
            "description": "skipped: Lynis is not installed on the server",
            "enum": [
              "pending",
              "succeeded",
              "failed",
              "skipped"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "scheduled",
              "manual"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "action",
          "trigger",
          "status",
          "indexBefore",
          "hardeningIndex",
          "outcomes",
          "fixIds",
          "createdAt",
          "finishedAt"
        ],
        "type": "object"
      },
      "HardeningView": {
        "additionalProperties": false,
        "properties": {
          "agentSupported": {
            "description": "The server's agent can audit the host",
            "type": "boolean"
          },
          "auditedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "firstIndex": {
            "description": "The score of the first audit",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "fixes": {
            "items": {
              "$ref": "#/components/schemas/HardeningFix"
            },
            "type": "array"
          },
          "hardeningIndex": {
            "description": "Lynis's 0 to 100 score from the latest audit; null before the first audit",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "lynisInstalled": {
            "type": "boolean"
          },
          "lynisVersion": {
            "type": "string"
          },
          "mode": {
            "description": "How the agent reaches the host: directly, or through a privileged helper container",
            "enum": [
              "host",
              "helper",
              ""
            ],
            "type": "string"
          },
          "nextAuditAt": {
            "description": "The next weekly audit; null when the weekly audit is off",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "pendingSafe": {
            "description": "Default fixes that would change something now",
            "format": "int64",
            "type": "integer"
          },
          "rebootRequired": {
            "description": "An applied fix takes effect after the next reboot",
            "type": "boolean"
          },
          "remaining": {
            "items": {
              "$ref": "#/components/schemas/HardeningRemaining"
            },
            "type": "array"
          },
          "running": {
            "description": "An audit or fix run waits for the agent or is running",
            "type": "boolean"
          },
          "runs": {
            "description": "The most recent runs, newest first",
            "items": {
              "$ref": "#/components/schemas/HardeningRun"
            },
            "type": "array"
          },
          "suggestions": {
            "format": "int64",
            "type": "integer"
          },
          "testsDone": {
            "format": "int64",
            "type": "integer"
          },
          "warnings": {
            "format": "int64",
            "type": "integer"
          },
          "weekly": {
            "description": "A weekly audit runs (default true)",
            "type": "boolean"
          }
        },
        "required": [
          "agentSupported",
          "weekly",
          "running",
          "lynisInstalled",
          "hardeningIndex",
          "firstIndex",
          "auditedAt",
          "nextAuditAt",
          "testsDone",
          "rebootRequired",
          "pendingSafe",
          "warnings",
          "suggestions",
          "fixes",
          "remaining",
          "runs"
        ],
        "type": "object"
      },
      "Header": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "value"
        ],
        "type": "object"
      },
      "Healthcheck": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deadlineSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "intervalSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "path": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "startPeriodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "successThreshold": {
            "format": "int64",
            "type": "integer"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type",
          "intervalSeconds",
          "timeoutSeconds",
          "startPeriodSeconds",
          "deadlineSeconds",
          "successThreshold"
        ],
        "type": "object"
      },
      "HealthcheckInput": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deadlineSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "intervalSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "path": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "startPeriodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "successThreshold": {
            "format": "int64",
            "type": "integer"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "enum": [
              "http",
              "tcp",
              "docker",
              "exec",
              "none"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "HistoryOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/VariableHistoryEntry"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "HookStatusView": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "mode": {
            "enum": [
              "app",
              "registered",
              "manual"
            ],
            "type": "string"
          },
          "status": {
            "enum": [
              "active",
              "error"
            ],
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "mode",
          "status",
          "message",
          "url"
        ],
        "type": "object"
      },
      "HostShellInfoView": {
        "additionalProperties": false,
        "properties": {
          "activeSessions": {
            "description": "Host shells the caller has open.",
            "format": "int64",
            "type": "integer"
          },
          "available": {
            "description": "A session can be opened now: enabled, the server online and the caller's account has two-factor authentication.",
            "type": "boolean"
          },
          "enabled": {
            "description": "An admin switched the host shell on for this server (default off).",
            "type": "boolean"
          },
          "idleTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "maxSessions": {
            "format": "int64",
            "type": "integer"
          },
          "production": {
            "description": "A service of a production environment runs on this server: opening a shell needs confirmProduction.",
            "type": "boolean"
          },
          "reason": {
            "description": "Why Available is false, in a sentence.",
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "twoFactorEnabled": {
            "description": "The caller's account has two-factor authentication.",
            "type": "boolean"
          }
        },
        "required": [
          "serverId",
          "serverName",
          "enabled",
          "available",
          "production",
          "twoFactorEnabled",
          "maxSessions",
          "activeSessions",
          "idleTimeoutSeconds"
        ],
        "type": "object"
      },
      "HostShellSettingsView": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "description": "Allow Owners and Admins with two-factor authentication to open a root shell on this server.",
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "HostTailscale": {
        "additionalProperties": false,
        "properties": {
          "detected": {
            "type": "boolean"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "detected"
        ],
        "type": "object"
      },
      "HostView": {
        "additionalProperties": false,
        "properties": {
          "fingerprint": {
            "type": "string"
          },
          "firstSeenAt": {
            "format": "date-time",
            "type": "string"
          },
          "host": {
            "description": "known_hosts name: host, or [host]:port",
            "type": "string"
          },
          "keyType": {
            "type": "string"
          },
          "mismatch": {
            "$ref": "#/components/schemas/MismatchView",
            "description": "Set when the server last presented a different key: clones fail until the new key is accepted"
          }
        },
        "required": [
          "host",
          "keyType",
          "fingerprint",
          "firstSeenAt"
        ],
        "type": "object"
      },
      "IPListView": {
        "additionalProperties": false,
        "properties": {
          "builtinDate": {
            "description": "The day the built-in list was fetched (YYYY-MM-DD)",
            "type": "string"
          },
          "changedAt": {
            "description": "The last time the content changed; null while the built-in list is in use",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "failingSince": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "fetchedAt": {
            "description": "The last successful fetch; null while the built-in list is in use",
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "hash": {
            "type": "string"
          },
          "lastError": {
            "description": "Why the last fetch failed; empty after a successful one",
            "type": "string"
          },
          "source": {
            "description": "Where the list came from: the copy built into the binary, the Cloudflare API or the published text files",
            "enum": [
              "builtin",
              "api",
              "text"
            ],
            "type": "string"
          },
          "stale": {
            "description": "Fetching has failed for more than 24 hours",
            "type": "boolean"
          },
          "v4Count": {
            "format": "int64",
            "type": "integer"
          },
          "v6Count": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "source",
          "v4Count",
          "v6Count",
          "hash",
          "fetchedAt",
          "changedAt",
          "builtinDate",
          "lastError",
          "failingSince",
          "stale"
        ],
        "type": "object"
      },
      "IdentityBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastLoginAt": {
            "format": "date-time",
            "type": "string"
          },
          "linkedAt": {
            "format": "date-time",
            "type": "string"
          },
          "providerKind": {
            "type": "string"
          },
          "providerName": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "providerName",
          "providerKind",
          "email",
          "linkedAt"
        ],
        "type": "object"
      },
      "IncidentView": {
        "additionalProperties": false,
        "properties": {
          "detail": {
            "type": "string"
          },
          "flapping": {
            "description": "The incident absorbed repeated failures; alerts for the service were paused until it was stable.",
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "description": "The worst kind the incident reached.",
            "enum": [
              "unhealthy",
              "crashed",
              "restart_loop"
            ],
            "type": "string"
          },
          "openedAt": {
            "format": "date-time",
            "type": "string"
          },
          "resolution": {
            "description": "Empty while the incident is open.",
            "enum": [
              "",
              "recovered",
              "stopped",
              "deleted"
            ],
            "type": "string"
          },
          "resolvedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "restarts": {
            "description": "Docker restarts counted when the incident was last updated.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "kind",
          "flapping",
          "detail",
          "restarts",
          "openedAt",
          "resolvedAt",
          "resolution"
        ],
        "type": "object"
      },
      "InfoView": {
        "additionalProperties": false,
        "properties": {
          "connections": {
            "format": "int64",
            "type": "integer"
          },
          "error": {
            "type": "string"
          },
          "sizeBytes": {
            "format": "int64",
            "type": "integer"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "sizeBytes",
          "connections",
          "updatedAt"
        ],
        "type": "object"
      },
      "InstanceBackupView": {
        "additionalProperties": false,
        "properties": {
          "destination": {
            "$ref": "#/components/schemas/InstanceDestinationView"
          },
          "enabled": {
            "type": "boolean"
          },
          "keyAcknowledgedAt": {
            "description": "When an admin confirmed the instance secret key is stored separately. The reminder card shows until then.",
            "format": "date-time",
            "type": "string"
          },
          "keyFingerprint": {
            "type": "string"
          },
          "lastRun": {
            "$ref": "#/components/schemas/InstanceRunView",
            "description": "The most recent run of any outcome."
          },
          "lastSuccessAt": {
            "format": "date-time",
            "type": "string"
          },
          "localDirEnabled": {
            "description": "False when NEBULACTRL_BACKUP_DIR is not set: local directory destinations are unavailable.",
            "type": "boolean"
          },
          "nextRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "retentionCount": {
            "description": "Successful backups kept (the newest is never removed).",
            "format": "int64",
            "type": "integer"
          },
          "schedule": {
            "description": "5-field cron expression, evaluated in UTC.",
            "type": "string"
          },
          "toolsAvailable": {
            "description": "False when pg_dump is missing on the control-plane host: backups can not run.",
            "type": "boolean"
          },
          "toolsMessage": {
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "schedule",
          "retentionCount",
          "destination",
          "keyFingerprint",
          "toolsAvailable",
          "localDirEnabled",
          "updatedAt"
        ],
        "type": "object"
      },
      "InstanceDestinationView": {
        "additionalProperties": false,
        "properties": {
          "accessKeySet": {
            "type": "boolean"
          },
          "bucket": {
            "type": "string"
          },
          "compatMode": {
            "type": "boolean"
          },
          "configured": {
            "description": "The destination has everything a backup needs (a bucket and keys, or a usable local directory).",
            "type": "boolean"
          },
          "endpoint": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "lastTestAt": {
            "format": "date-time",
            "type": "string"
          },
          "lastTestMessage": {
            "type": "string"
          },
          "lastTestOk": {
            "type": "boolean"
          },
          "localDir": {
            "type": "string"
          },
          "offSite": {
            "description": "False for a directory on the control-plane host: it does not survive the loss of that host.",
            "type": "boolean"
          },
          "pathStyle": {
            "type": "boolean"
          },
          "prefix": {
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "secretKeySet": {
            "type": "boolean"
          },
          "where": {
            "description": "Human-readable location, e.g. s3://bucket/prefix.",
            "type": "string"
          }
        },
        "required": [
          "kind",
          "pathStyle",
          "compatMode",
          "accessKeySet",
          "secretKeySet",
          "configured",
          "offSite",
          "where"
        ],
        "type": "object"
      },
      "InstanceRunListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/InstanceRunView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "InstanceRunView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "destKind": {
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "destination": {
            "description": "Where the backup was written.",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "objectDeleted": {
            "description": "Retention removed the stored objects; the row stays as history.",
            "type": "boolean"
          },
          "objectKey": {
            "type": "string"
          },
          "pgVersion": {
            "type": "string"
          },
          "sha256": {
            "type": "string"
          },
          "sizeBytes": {
            "format": "int64",
            "type": "integer"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "running",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "schedule",
              "manual",
              "pre_upgrade"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "trigger",
          "status",
          "destination",
          "destKind",
          "sizeBytes",
          "startedAt",
          "objectDeleted"
        ],
        "type": "object"
      },
      "InstanceSettings": {
        "additionalProperties": false,
        "properties": {
          "allowTeamCreation": {
            "description": "Whether any user may create a team (the instance admin always may)",
            "type": "boolean"
          },
          "canManage": {
            "description": "The caller is the instance admin and may change these settings",
            "type": "boolean"
          },
          "smtpConfigured": {
            "description": "Invites can be emailed through the instance relay",
            "type": "boolean"
          },
          "smtpFrom": {
            "type": "string"
          },
          "smtpHost": {
            "type": "string"
          },
          "smtpInsecureSkipVerify": {
            "type": "boolean"
          },
          "smtpPasswordSet": {
            "type": "boolean"
          },
          "smtpPort": {
            "format": "int64",
            "type": "integer"
          },
          "smtpTls": {
            "enum": [
              "implicit",
              "starttls",
              "none"
            ],
            "type": "string"
          },
          "smtpUsername": {
            "type": "string"
          }
        },
        "required": [
          "allowTeamCreation",
          "canManage",
          "smtpConfigured"
        ],
        "type": "object"
      },
      "InstanceUpgradeView": {
        "additionalProperties": false,
        "properties": {
          "agentAutoUpgrade": {
            "description": "Upgrade an agent that is behind the control plane as soon as it connects. Default on.",
            "type": "boolean"
          },
          "behind": {
            "description": "Servers whose agent is behind the control plane.",
            "format": "int64",
            "type": "integer"
          },
          "controlPlaneVersion": {
            "type": "string"
          },
          "preUpgradeBackup": {
            "$ref": "#/components/schemas/PreUpgradeBackupView"
          },
          "servers": {
            "items": {
              "$ref": "#/components/schemas/ServerUpgradeView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "upgradable": {
            "description": "Servers whose agent can be upgraded now.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "controlPlaneVersion",
          "agentAutoUpgrade",
          "behind",
          "upgradable",
          "servers"
        ],
        "type": "object"
      },
      "InvitePreview": {
        "additionalProperties": false,
        "properties": {
          "accountExists": {
            "type": "boolean"
          },
          "email": {
            "description": "Set when the invite is bound to one email address",
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "invitedBy": {
            "description": "Display name of the person who created the invite",
            "type": "string"
          },
          "role": {
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          },
          "teamName": {
            "type": "string"
          },
          "teamSlug": {
            "type": "string"
          }
        },
        "required": [
          "teamName",
          "teamSlug",
          "role",
          "expiresAt",
          "accountExists"
        ],
        "type": "object"
      },
      "KeyView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "fingerprint": {
            "type": "string"
          },
          "publicKey": {
            "type": "string"
          },
          "rotatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "source": {
            "enum": [
              "generated",
              "uploaded"
            ],
            "type": "string"
          },
          "type": {
            "description": "Key algorithm, e.g. ssh-ed25519",
            "type": "string"
          }
        },
        "required": [
          "publicKey",
          "fingerprint",
          "type",
          "source",
          "createdAt"
        ],
        "type": "object"
      },
      "Latest": {
        "additionalProperties": false,
        "properties": {
          "cpuPercent": {
            "format": "double",
            "type": "number"
          },
          "diskTotal": {
            "format": "int64",
            "type": "integer"
          },
          "diskUsed": {
            "format": "int64",
            "type": "integer"
          },
          "memTotal": {
            "format": "int64",
            "type": "integer"
          },
          "memUsed": {
            "format": "int64",
            "type": "integer"
          },
          "sampledAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "cpuPercent",
          "memUsed",
          "memTotal",
          "diskUsed",
          "diskTotal",
          "sampledAt"
        ],
        "type": "object"
      },
      "Layout": {
        "additionalProperties": false,
        "properties": {
          "groups": {
            "items": {
              "$ref": "#/components/schemas/Group"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nodes": {
            "additionalProperties": {
              "$ref": "#/components/schemas/Pos"
            },
            "type": "object"
          },
          "viewport": {
            "$ref": "#/components/schemas/Viewport"
          }
        },
        "required": [
          "nodes",
          "groups",
          "viewport"
        ],
        "type": "object"
      },
      "LinkInputBody": {
        "additionalProperties": false,
        "properties": {
          "autoDeploy": {
            "description": "Deploy on every push to the branch (default: keep the current setting, true for a new link)",
            "type": "boolean"
          },
          "branch": {
            "description": "Defaults to the service's branch for the same repository, else the repository's default branch",
            "maxLength": 250,
            "type": "string"
          },
          "connectionId": {
            "type": "string"
          },
          "repo": {
            "description": "owner/name (or a clone URL)",
            "maxLength": 300,
            "minLength": 3,
            "type": "string"
          },
          "watchPaths": {
            "description": "Monorepo watch paths: globs relative to the repository root ('apps/api/**', 'packages/*/src', '!**/*.md'); a push only deploys when a changed file matches. Empty watches everything.",
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "type": "array"
          }
        },
        "required": [
          "connectionId",
          "repo"
        ],
        "type": "object"
      },
      "LinkListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/LinkView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "LinkPreview": {
        "additionalProperties": false,
        "properties": {
          "existingKeys": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "linked": {
            "type": "boolean"
          },
          "mesh": {
            "$ref": "#/components/schemas/MeshPlan"
          },
          "proposedVariables": {
            "items": {
              "$ref": "#/components/schemas/ProposedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "proposedVariables",
          "warnings",
          "existingKeys",
          "linked",
          "mesh"
        ],
        "type": "object"
      },
      "LinkReferenceKey": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "staged": {
            "description": "The source service's running release does not hold this reference yet; it applies on its next deploy",
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "staged"
        ],
        "type": "object"
      },
      "LinkResult": {
        "additionalProperties": false,
        "properties": {
          "link": {
            "$ref": "#/components/schemas/LinkView"
          },
          "mesh": {
            "$ref": "#/components/schemas/MeshPlan"
          },
          "proposedVariables": {
            "items": {
              "$ref": "#/components/schemas/ProposedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "link",
          "proposedVariables",
          "warnings",
          "mesh"
        ],
        "type": "object"
      },
      "LinkView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "fromServiceId": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "references": {
            "description": "Variables of the source service that reference the target",
            "items": {
              "$ref": "#/components/schemas/LinkReferenceKey"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "source": {
            "description": "A manual link that is also referenced by variables reports manual",
            "enum": [
              "manual",
              "reference"
            ],
            "type": "string"
          },
          "staged": {
            "description": "Every reference that makes this link is staged: the edge is drawn but not live until the source deploys",
            "type": "boolean"
          },
          "toServiceId": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "environmentId",
          "fromServiceId",
          "toServiceId",
          "source",
          "references",
          "staged",
          "createdAt"
        ],
        "type": "object"
      },
      "ListConnectionsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ConnectionView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListIncidentsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/IncidentView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListInvitesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TeamInvite"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListMembersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TeamMember"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListNetworksOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/NetworkView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/SecretManager"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListOutputBody1": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DomainView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListOutputBody2": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PreviewView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListOutputBody3": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RegistryView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListTeamsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Team"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ListTokensOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Token"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "LockInputBody": {
        "additionalProperties": false,
        "properties": {
          "locked": {
            "type": "boolean"
          }
        },
        "required": [
          "locked"
        ],
        "type": "object"
      },
      "LockVolumeBackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "locked": {
            "type": "boolean"
          }
        },
        "required": [
          "locked"
        ],
        "type": "object"
      },
      "LogDrainSecretsInput": {
        "additionalProperties": false,
        "properties": {
          "clear": {
            "description": "Credentials to remove: token, username, password, headers.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "headers": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Extra request headers (an API key header, for example). Replaces the stored set.",
            "type": "object"
          },
          "password": {
            "description": "Basic auth password (Loki, HTTP).",
            "type": "string"
          },
          "token": {
            "description": "Bearer token (Loki, OTLP, HTTP).",
            "type": "string"
          },
          "username": {
            "description": "Basic auth user (Loki, HTTP).",
            "type": "string"
          }
        },
        "type": "object"
      },
      "LogDrainServerStatus": {
        "additionalProperties": false,
        "properties": {
          "backlogBytes": {
            "format": "int64",
            "type": "integer"
          },
          "droppedLines": {
            "format": "int64",
            "type": "integer"
          },
          "lastError": {
            "type": "string"
          },
          "lastErrorAt": {
            "format": "date-time",
            "type": "string"
          },
          "lastSuccessAt": {
            "format": "date-time",
            "type": "string"
          },
          "reportedAt": {
            "format": "date-time",
            "type": "string"
          },
          "sentLines": {
            "format": "int64",
            "type": "integer"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "state": {
            "enum": [
              "ok",
              "retrying",
              "failing",
              "disabled"
            ],
            "type": "string"
          }
        },
        "required": [
          "serverId",
          "serverName",
          "state",
          "lastError",
          "sentLines",
          "droppedLines",
          "backlogBytes",
          "reportedAt"
        ],
        "type": "object"
      },
      "LogDrainTestResult": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "statusCode": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "ok",
          "message",
          "serverId",
          "serverName"
        ],
        "type": "object"
      },
      "LogDrainTestState": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          }
        },
        "required": [
          "message"
        ],
        "type": "object"
      },
      "LogDrainView": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "type": "boolean"
          },
          "bufferMb": {
            "description": "Undelivered backlog a drain keeps on each server's disk.",
            "format": "int64",
            "type": "integer"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "headerNames": {
            "description": "Names of the stored extra headers; their values are secret.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "http": {
            "$ref": "#/components/schemas/HTTPDrainConfig"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "loki",
              "otlp",
              "syslog",
              "http"
            ],
            "type": "string"
          },
          "loki": {
            "$ref": "#/components/schemas/LokiDrainConfig"
          },
          "name": {
            "type": "string"
          },
          "otlp": {
            "$ref": "#/components/schemas/OTLPDrainConfig"
          },
          "projectIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "query": {
            "description": "Only lines matching this log search query are shipped (empty: every line).",
            "type": "string"
          },
          "secrets": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "A mask for each credential that is set (token, username, password); never its value.",
            "type": "object"
          },
          "servers": {
            "description": "The drain's health on each server that reported it.",
            "items": {
              "$ref": "#/components/schemas/LogDrainServerStatus"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "serviceIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "syslog": {
            "$ref": "#/components/schemas/SyslogDrainConfig"
          },
          "test": {
            "$ref": "#/components/schemas/LogDrainTestState"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "enabled",
          "secrets",
          "headerNames",
          "allProjects",
          "projectIds",
          "serviceIds",
          "query",
          "bufferMb",
          "test",
          "servers",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "LogHistoryEntry": {
        "additionalProperties": false,
        "properties": {
          "deploymentId": {
            "type": "string"
          },
          "line": {
            "type": "string"
          },
          "replica": {
            "format": "int64",
            "type": "integer"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "stream": {
            "type": "string"
          },
          "ts": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "ts",
          "line",
          "serviceId",
          "replica",
          "stream"
        ],
        "type": "object"
      },
      "LogHistoryPage": {
        "additionalProperties": false,
        "properties": {
          "capturing": {
            "type": "boolean"
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/LogHistoryEntry"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "newest": {
            "format": "date-time",
            "type": "string"
          },
          "nextCursor": {
            "type": "string"
          },
          "oldest": {
            "description": "The oldest line the server still has.",
            "format": "date-time",
            "type": "string"
          },
          "partial": {
            "type": "boolean"
          },
          "queryErrors": {
            "description": "The parts of the query that were ignored.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "unavailable": {
            "description": "Services whose history could not be read (their server is offline, for example).",
            "items": {
              "$ref": "#/components/schemas/LogHistoryUnavailable"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "capturing"
        ],
        "type": "object"
      },
      "LogHistoryUnavailable": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "reason": {
            "enum": [
              "server_offline",
              "agent_outdated",
              "failed"
            ],
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "serviceName",
          "serverId",
          "serverName",
          "reason",
          "message"
        ],
        "type": "object"
      },
      "LogServerUsage": {
        "additionalProperties": false,
        "properties": {
          "reportedAt": {
            "format": "date-time",
            "type": "string"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/LogServiceUsage"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "totalBytes": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "totalBytes",
          "services",
          "reportedAt"
        ],
        "type": "object"
      },
      "LogServiceUsage": {
        "additionalProperties": false,
        "properties": {
          "bytes": {
            "format": "int64",
            "type": "integer"
          },
          "lines": {
            "format": "int64",
            "type": "integer"
          },
          "newest": {
            "format": "date-time",
            "type": "string"
          },
          "oldest": {
            "format": "date-time",
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "bytes",
          "lines"
        ],
        "type": "object"
      },
      "LogSettingsView": {
        "additionalProperties": false,
        "properties": {
          "capture": {
            "description": "Capture the runtime output of this server's services. Off: nothing new is stored; what is stored stays until it expires.",
            "type": "boolean"
          },
          "maxServerBytes": {
            "description": "Cap for the whole server; the oldest lines of any service go first.",
            "format": "int64",
            "type": "integer"
          },
          "maxServiceBytes": {
            "description": "Cap per service; the oldest lines go first.",
            "format": "int64",
            "type": "integer"
          },
          "online": {
            "type": "boolean"
          },
          "retentionDays": {
            "format": "int64",
            "type": "integer"
          },
          "usage": {
            "$ref": "#/components/schemas/LogServerUsage",
            "description": "What the agent last reported; absent until it has."
          }
        },
        "required": [
          "capture",
          "retentionDays",
          "maxServiceBytes",
          "maxServerBytes",
          "online"
        ],
        "type": "object"
      },
      "LoginInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "maxLength": 254,
            "type": "string"
          },
          "password": {
            "maxLength": 256,
            "type": "string"
          }
        },
        "required": [
          "email",
          "password"
        ],
        "type": "object"
      },
      "LokiDrainConfig": {
        "additionalProperties": false,
        "properties": {
          "labels": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "tenantId": {
            "type": "string"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "MaintenanceView": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "eta": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "since": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "title": {
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "title",
          "message",
          "eta",
          "since"
        ],
        "type": "object"
      },
      "ManifestInputBody": {
        "additionalProperties": false,
        "properties": {
          "baseUrl": {
            "description": "Web URL of a GitHub Enterprise Server (empty: github.com)",
            "maxLength": 300,
            "type": "string"
          },
          "name": {
            "description": "Connection name (default GitHub)",
            "maxLength": 80,
            "type": "string"
          },
          "owner": {
            "description": "GitHub organization that should own the App (empty: your own account)",
            "maxLength": 64,
            "type": "string"
          }
        },
        "type": "object"
      },
      "ManifestStart": {
        "additionalProperties": false,
        "properties": {
          "connectionId": {
            "type": "string"
          },
          "manifest": {
            "type": "string"
          },
          "postUrl": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "connectionId",
          "postUrl",
          "manifest",
          "state"
        ],
        "type": "object"
      },
      "MeBody": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "instanceAdmin": {
            "description": "The first user: manages instance settings",
            "type": "boolean"
          },
          "name": {
            "type": "string"
          },
          "principal": {
            "$ref": "#/components/schemas/PrincipalBody"
          },
          "workspaceId": {
            "type": "string"
          }
        },
        "required": [
          "instanceAdmin",
          "principal",
          "id",
          "email",
          "name",
          "workspaceId",
          "createdAt"
        ],
        "type": "object"
      },
      "MeshBlocker": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "MeshGrantView": {
        "additionalProperties": false,
        "properties": {
          "exposureId": {
            "type": "string"
          },
          "meshPort": {
            "format": "int64",
            "type": "integer"
          },
          "providerSlug": {
            "type": "string"
          },
          "refId": {
            "type": "string"
          },
          "refLabel": {
            "type": "string"
          },
          "source": {
            "enum": [
              "reference",
              "edge",
              "replica"
            ],
            "type": "string"
          }
        },
        "required": [
          "exposureId",
          "providerSlug",
          "refId",
          "refLabel",
          "source",
          "meshPort"
        ],
        "type": "object"
      },
      "MeshLinkView": {
        "additionalProperties": false,
        "properties": {
          "environmentId": {
            "type": "string"
          },
          "environmentName": {
            "type": "string"
          },
          "grants": {
            "items": {
              "$ref": "#/components/schemas/MeshGrantView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostname": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "needsReprovision": {
            "type": "boolean"
          },
          "projectName": {
            "type": "string"
          },
          "purpose": {
            "enum": [
              "replication",
              "service"
            ],
            "type": "string"
          },
          "remoteServerId": {
            "type": "string"
          },
          "remoteServerName": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "state": {
            "enum": [
              "provisioning",
              "online",
              "degraded",
              "offline",
              "needs_attention",
              "removing",
              "unknown"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "environmentId",
          "environmentName",
          "projectName",
          "serverId",
          "serverName",
          "remoteServerId",
          "remoteServerName",
          "purpose",
          "state",
          "message",
          "hostname",
          "ips",
          "needsReprovision",
          "grants"
        ],
        "type": "object"
      },
      "MeshPlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "$ref": "#/components/schemas/MeshBlocker"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "crossServer": {
            "type": "boolean"
          },
          "devicesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "links": {
            "items": {
              "$ref": "#/components/schemas/MeshPlanLink"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "crossServer",
          "links",
          "devicesAdded",
          "blockers"
        ],
        "type": "object"
      },
      "MeshPlanLink": {
        "additionalProperties": false,
        "properties": {
          "fromServerId": {
            "type": "string"
          },
          "fromServerName": {
            "type": "string"
          },
          "providers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "purpose": {
            "enum": [
              "service",
              "replication"
            ],
            "type": "string"
          },
          "state": {
            "type": "string"
          },
          "toServerId": {
            "type": "string"
          },
          "toServerName": {
            "type": "string"
          }
        },
        "required": [
          "fromServerId",
          "fromServerName",
          "toServerId",
          "toServerName",
          "purpose",
          "state",
          "providers"
        ],
        "type": "object"
      },
      "MeshServerRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name"
        ],
        "type": "object"
      },
      "MessageField": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "value"
        ],
        "type": "object"
      },
      "MetricPoint": {
        "additionalProperties": false,
        "properties": {
          "cpuMax": {
            "format": "double",
            "type": "number"
          },
          "cpuPercent": {
            "format": "double",
            "type": "number"
          },
          "diskPercent": {
            "format": "double",
            "type": "number"
          },
          "diskTotalBytes": {
            "format": "int64",
            "type": "integer"
          },
          "diskUsedBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memMax": {
            "format": "int64",
            "type": "integer"
          },
          "memPercent": {
            "format": "double",
            "type": "number"
          },
          "memTotalBytes": {
            "format": "int64",
            "type": "integer"
          },
          "ts": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "ts",
          "cpuPercent",
          "cpuMax",
          "memBytes",
          "memMax",
          "memTotalBytes",
          "memPercent",
          "diskUsedBytes",
          "diskTotalBytes",
          "diskPercent"
        ],
        "type": "object"
      },
      "MetricsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "points": {
            "items": {
              "$ref": "#/components/schemas/ServiceMetricPoint"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "retentionDays": {
            "description": "Days of history kept on the service's server; longer ranges only show what is retained",
            "format": "int64",
            "type": "integer"
          },
          "stepSeconds": {
            "description": "Bucket width of every point",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "points",
          "stepSeconds",
          "retentionDays"
        ],
        "type": "object"
      },
      "MismatchView": {
        "additionalProperties": false,
        "properties": {
          "fingerprint": {
            "type": "string"
          },
          "seenAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "fingerprint",
          "seenAt"
        ],
        "type": "object"
      },
      "Move": {
        "additionalProperties": false,
        "properties": {
          "deploymentId": {
            "type": "string"
          },
          "deploymentStatus": {
            "type": "string"
          },
          "environmentName": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "projectName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "sourceServerId": {
            "type": "string"
          },
          "stateful": {
            "type": "boolean"
          },
          "status": {
            "enum": [
              "pending",
              "moving",
              "deploying",
              "done",
              "failed"
            ],
            "type": "string"
          },
          "targetServerId": {
            "type": "string"
          },
          "targetServerName": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "serviceName",
          "projectName",
          "environmentName",
          "sourceServerId",
          "targetServerId",
          "targetServerName",
          "stateful",
          "status",
          "deploymentId",
          "message"
        ],
        "type": "object"
      },
      "MoveBody": {
        "additionalProperties": false,
        "properties": {
          "serviceId": {
            "type": "string"
          },
          "targetServerId": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "targetServerId"
        ],
        "type": "object"
      },
      "MoveIncomingRef": {
        "additionalProperties": false,
        "properties": {
          "keys": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "service": {
            "type": "string"
          }
        },
        "required": [
          "service",
          "keys"
        ],
        "type": "object"
      },
      "MoveResult": {
        "additionalProperties": false,
        "properties": {
          "applied": {
            "type": "boolean"
          },
          "blocked": {
            "type": "boolean"
          },
          "dryRun": {
            "type": "boolean"
          },
          "from": {
            "$ref": "#/components/schemas/CloneEnvironmentRef"
          },
          "incoming": {
            "items": {
              "$ref": "#/components/schemas/MoveIncomingRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "links": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "outgoing": {
            "items": {
              "$ref": "#/components/schemas/ReferenceFinding"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "service": {
            "$ref": "#/components/schemas/ServiceView"
          },
          "slug": {
            "type": "string"
          },
          "slugChanged": {
            "type": "boolean"
          },
          "to": {
            "$ref": "#/components/schemas/CloneEnvironmentRef"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "dryRun",
          "applied",
          "blocked",
          "from",
          "to",
          "slug",
          "slugChanged",
          "outgoing",
          "incoming",
          "links",
          "warnings"
        ],
        "type": "object"
      },
      "MoveServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "dryRun": {
            "description": "Report the plan (references, links, slug) and change nothing",
            "type": "boolean"
          },
          "environmentId": {
            "description": "The environment to move the service to",
            "type": "string"
          },
          "force": {
            "description": "Move even though references from or to the service break",
            "type": "boolean"
          }
        },
        "required": [
          "environmentId"
        ],
        "type": "object"
      },
      "NetworkRef": {
        "additionalProperties": false,
        "properties": {
          "alias": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "serverId",
          "alias"
        ],
        "type": "object"
      },
      "NetworkView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "dockerName": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "services": {
            "description": "Services attached (staged or deployed); services of projects the token cannot see are left out",
            "items": {
              "$ref": "#/components/schemas/AttachedService"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "name",
          "serverId",
          "serverName",
          "dockerName",
          "services",
          "createdAt"
        ],
        "type": "object"
      },
      "NodeExposureView": {
        "additionalProperties": false,
        "properties": {
          "meshPort": {
            "format": "int64",
            "type": "integer"
          },
          "purpose": {
            "enum": [
              "replication",
              "service"
            ],
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "serviceName",
          "purpose",
          "meshPort"
        ],
        "type": "object"
      },
      "NodeView": {
        "additionalProperties": false,
        "properties": {
          "agentCapable": {
            "type": "boolean"
          },
          "devices": {
            "description": "This node plus the link nodes that run on this server",
            "format": "int64",
            "type": "integer"
          },
          "exposures": {
            "items": {
              "$ref": "#/components/schemas/NodeExposureView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "fqdn": {
            "type": "string"
          },
          "hostname": {
            "type": "string"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "lastSeenAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "needsReprovision": {
            "type": "boolean"
          },
          "peers": {
            "items": {
              "$ref": "#/components/schemas/PeerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "state": {
            "enum": [
              "provisioning",
              "online",
              "offline",
              "needs_attention",
              "unknown"
            ],
            "type": "string"
          },
          "tunDevice": {
            "type": "boolean"
          }
        },
        "required": [
          "serverId",
          "serverName",
          "state",
          "message",
          "hostname",
          "fqdn",
          "ips",
          "needsReprovision",
          "peers",
          "exposures",
          "devices",
          "lastSeenAt",
          "tunDevice",
          "agentCapable"
        ],
        "type": "object"
      },
      "OAuthView": {
        "additionalProperties": false,
        "properties": {
          "authorized": {
            "type": "boolean"
          },
          "clientId": {
            "type": "string"
          },
          "redirectUri": {
            "description": "Register this as the OAuth application's redirect URI",
            "type": "string"
          }
        },
        "required": [
          "clientId",
          "redirectUri",
          "authorized"
        ],
        "type": "object"
      },
      "OTLPDrainConfig": {
        "additionalProperties": false,
        "properties": {
          "resourceAttributes": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "url": {
            "type": "string"
          }
        },
        "required": [
          "url"
        ],
        "type": "object"
      },
      "ObservedReplicaView": {
        "additionalProperties": false,
        "properties": {
          "component": {
            "type": "string"
          },
          "containerId": {
            "type": "string"
          },
          "health": {
            "type": "string"
          },
          "index": {
            "format": "int64",
            "type": "integer"
          },
          "restartCount": {
            "format": "int64",
            "type": "integer"
          },
          "startedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "index",
          "containerId",
          "state",
          "health",
          "startedAt",
          "restartCount",
          "component"
        ],
        "type": "object"
      },
      "ObservedView": {
        "additionalProperties": false,
        "properties": {
          "containerId": {
            "type": "string"
          },
          "deploymentId": {
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "health": {
            "type": "string"
          },
          "imageId": {
            "type": "string"
          },
          "replicas": {
            "items": {
              "$ref": "#/components/schemas/ObservedReplicaView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "replicasDesired": {
            "format": "int64",
            "type": "integer"
          },
          "replicasReady": {
            "format": "int64",
            "type": "integer"
          },
          "startedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "state",
          "health",
          "containerId",
          "startedAt",
          "imageId",
          "replicas",
          "replicasReady",
          "replicasDesired"
        ],
        "type": "object"
      },
      "OriginLockView": {
        "additionalProperties": false,
        "properties": {
          "aop": {
            "enum": [
              "on",
              "off",
              "unavailable"
            ],
            "type": "string"
          },
          "aopReason": {
            "description": "Why Authenticated Origin Pulls is unavailable; empty otherwise",
            "type": "string"
          },
          "aopReasonCode": {
            "enum": [
              "",
              "permission",
              "ssl_mode",
              "error"
            ],
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "ipListSource": {
            "enum": [
              "builtin",
              "api",
              "text"
            ],
            "type": "string"
          },
          "ipLock": {
            "type": "boolean"
          },
          "optIn": {
            "description": "The domain's setting. False is an opt-out: anyone who finds the server's IP can bypass Cloudflare",
            "type": "boolean"
          },
          "permissionHint": {
            "type": "string"
          },
          "realClientIp": {
            "type": "boolean"
          },
          "reason": {
            "enum": [
              "",
              "opted_out",
              "tunnel",
              "not_proxied",
              "dns_not_managed",
              "not_in_zone",
              "pending",
              "wildcard",
              "redirect"
            ],
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "optIn",
          "reason",
          "ipLock",
          "aop",
          "aopReason",
          "aopReasonCode",
          "realClientIp",
          "permissionHint",
          "ipListSource"
        ],
        "type": "object"
      },
      "Overview": {
        "additionalProperties": false,
        "properties": {
          "servers": {
            "items": {
              "$ref": "#/components/schemas/FleetServer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "totals": {
            "$ref": "#/components/schemas/FleetTotals"
          }
        },
        "required": [
          "servers",
          "totals"
        ],
        "type": "object"
      },
      "PageAuditEvent": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AuditEvent"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageDeploymentView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DeploymentView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageEnvDeploymentView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/EnvDeploymentView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageEnvironment": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Environment"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageProject": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Project"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageServer": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Server"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageServiceView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ServiceView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PageWebhookDeliveryView": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/WebhookDeliveryView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "description": "Present when more items exist",
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PasskeyBody": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastUsedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "synced": {
            "description": "The authenticator reports the passkey as backed up (it syncs between devices); false means it is bound to one device",
            "type": "boolean"
          },
          "transports": {
            "description": "How the authenticator connects (internal, usb, nfc, ble, hybrid)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "name",
          "createdAt",
          "synced",
          "transports"
        ],
        "type": "object"
      },
      "PasskeyDeleteInputBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "description": "Required when the account has a password",
            "maxLength": 256,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PasskeyRegisterFinishInputBody": {
        "additionalProperties": false,
        "properties": {
          "credential": {
            "description": "The RegistrationResponseJSON of the authenticator (PublicKeyCredential.toJSON())"
          },
          "name": {
            "description": "What to call this passkey, for example 'MacBook' or 'YubiKey'",
            "maxLength": 60,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name",
          "credential"
        ],
        "type": "object"
      },
      "PasskeyRegisterFinishOutputBody": {
        "additionalProperties": false,
        "properties": {
          "passkey": {
            "$ref": "#/components/schemas/PasskeyBody"
          },
          "recoveryCodes": {
            "description": "Issued when the account had no unused recovery code left; single use, shown once",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "passkey"
        ],
        "type": "object"
      },
      "PasskeyRegisterStartInputBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "description": "Required when the account has a password",
            "maxLength": 256,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PasskeyRenameInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "maxLength": 60,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "PasskeysOutputBody": {
        "additionalProperties": false,
        "properties": {
          "passkeys": {
            "items": {
              "$ref": "#/components/schemas/PasskeyBody"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "passkeys"
        ],
        "type": "object"
      },
      "PasswordResetConfirmInputBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "maxLength": 256,
            "minLength": 10,
            "type": "string"
          },
          "token": {
            "maxLength": 128,
            "type": "string"
          }
        },
        "required": [
          "token",
          "password"
        ],
        "type": "object"
      },
      "PasswordResetLink": {
        "additionalProperties": false,
        "properties": {
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "link": {
            "description": "Where the member sets a new password: an absolute URL when NEBULACTRL_PUBLIC_URL is set, otherwise a path",
            "type": "string"
          },
          "token": {
            "type": "string"
          }
        },
        "required": [
          "link",
          "token",
          "expiresAt"
        ],
        "type": "object"
      },
      "PasswordResetRequestInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "maxLength": 254,
            "type": "string"
          }
        },
        "required": [
          "email"
        ],
        "type": "object"
      },
      "PasswordResetRequestOutputBody": {
        "additionalProperties": false,
        "properties": {
          "status": {
            "description": "Always 'requested': the answer is the same whether or not the account exists",
            "enum": [
              "requested"
            ],
            "type": "string"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "PasswordResetStatusOutputBody": {
        "additionalProperties": false,
        "properties": {
          "available": {
            "description": "Whether the login page may offer Forgot password: an email can be sent and the control plane has a public URL",
            "type": "boolean"
          }
        },
        "required": [
          "available"
        ],
        "type": "object"
      },
      "PatchChannelInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ChannelConfig",
            "description": "Replaces the non-secret settings."
          },
          "enabled": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "rule": {
            "$ref": "#/components/schemas/ChannelRuleInput",
            "description": "Replaces the subscription rule."
          },
          "secrets": {
            "$ref": "#/components/schemas/ChannelSecretsInput",
            "description": "Fields left empty keep the stored credential."
          }
        },
        "type": "object"
      },
      "PatchDestinationInputBody": {
        "additionalProperties": false,
        "properties": {
          "accessKey": {
            "description": "Omit or leave empty to keep the stored key.",
            "type": "string"
          },
          "bucket": {
            "type": "string"
          },
          "compatMode": {
            "type": "boolean"
          },
          "endpoint": {
            "type": "string"
          },
          "localDir": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "pathStyle": {
            "type": "boolean"
          },
          "prefix": {
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "secretKey": {
            "description": "Omit or leave empty to keep the stored key.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchDrainInputBody": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "type": "boolean"
          },
          "bufferMb": {
            "format": "int64",
            "maximum": 5120,
            "minimum": 1,
            "type": "integer"
          },
          "config": {
            "$ref": "#/components/schemas/DrainConfigBody",
            "description": "Replaces the non-secret settings of the drain's kind."
          },
          "enabled": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "projectIds": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "query": {
            "type": "string"
          },
          "secrets": {
            "$ref": "#/components/schemas/LogDrainSecretsInput",
            "description": "Fields left empty keep the stored credential."
          },
          "serviceIds": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "PatchInputBody": {
        "additionalProperties": false,
        "properties": {
          "agentAutoUpgrade": {
            "description": "Upgrade an agent that is behind the control plane when it connects.",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "PatchInputBody1": {
        "additionalProperties": false,
        "properties": {
          "clearPull": {
            "description": "Remove the read-only credential.",
            "type": "boolean"
          },
          "host": {
            "maxLength": 253,
            "type": "string"
          },
          "manageRetention": {
            "description": "Let NebulaCtrl delete images that fall out of the rollback window. Managed registries only.",
            "type": "boolean"
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "namespace": {
            "maxLength": 200,
            "type": "string"
          },
          "pullPassword": {
            "description": "Omit to keep the stored password.",
            "maxLength": 4096,
            "type": "string"
          },
          "pullUsername": {
            "maxLength": 4096,
            "type": "string"
          },
          "pushPassword": {
            "description": "Omit to keep the stored password.",
            "maxLength": 4096,
            "type": "string"
          },
          "pushUsername": {
            "maxLength": 4096,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchInstanceBackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "accessKey": {
            "description": "Write-only. Omit or leave empty to keep the stored key.",
            "type": "string"
          },
          "bucket": {
            "type": "string"
          },
          "compatMode": {
            "type": "boolean"
          },
          "enabled": {
            "description": "Run the schedule. Needs a complete destination.",
            "type": "boolean"
          },
          "endpoint": {
            "description": "S3-compatible endpoint URL; empty means AWS S3.",
            "type": "string"
          },
          "kind": {
            "description": "Changing the kind starts the destination afresh.",
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "localDir": {
            "description": "Local destinations: relative sub-directory of NEBULACTRL_BACKUP_DIR.",
            "type": "string"
          },
          "pathStyle": {
            "type": "boolean"
          },
          "prefix": {
            "description": "Key prefix inside the bucket or directory.",
            "type": "string"
          },
          "region": {
            "type": "string"
          },
          "retentionCount": {
            "description": "Successful backups kept (default 14).",
            "format": "int64",
            "maximum": 365,
            "minimum": 1,
            "type": "integer"
          },
          "schedule": {
            "description": "5-field cron expression or @daily etc., evaluated in UTC (default 30 3 * * *). At most one run every 5 minutes.",
            "type": "string"
          },
          "secretKey": {
            "description": "Write-only. Omit or leave empty to keep the stored key.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchPackage": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "description": "Installed version, when the package manager says",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "risk": {
            "description": "Why upgrading this package deserves a warning, empty for ordinary packages",
            "type": "string"
          },
          "security": {
            "description": "The update comes from a security repository",
            "type": "boolean"
          },
          "to": {
            "description": "Version it would upgrade to",
            "type": "string"
          }
        },
        "required": [
          "name",
          "security"
        ],
        "type": "object"
      },
      "PatchPlan": {
        "additionalProperties": false,
        "properties": {
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "confirm": {
            "description": "What the person types to confirm: the server's name",
            "type": "string"
          },
          "controlPlane": {
            "type": "boolean"
          },
          "manager": {
            "enum": [
              "apt",
              "dnf",
              ""
            ],
            "type": "string"
          },
          "notReadyReason": {
            "type": "string"
          },
          "packages": {
            "items": {
              "$ref": "#/components/schemas/PatchPackage"
            },
            "type": "array"
          },
          "productionServices": {
            "items": {
              "$ref": "#/components/schemas/ProductionService"
            },
            "type": "array"
          },
          "ready": {
            "description": "The plan can be applied now",
            "type": "boolean"
          },
          "rebootLikely": {
            "description": "The upgrade probably leaves the server wanting a reboot",
            "type": "boolean"
          },
          "requiresAcknowledgement": {
            "type": "boolean"
          },
          "restartsDocker": {
            "description": "Docker is among the packages: its daemon restarts and containers may stop for a moment",
            "type": "boolean"
          },
          "risks": {
            "items": {
              "$ref": "#/components/schemas/PatchRisk"
            },
            "type": "array"
          },
          "security": {
            "format": "int64",
            "type": "integer"
          },
          "securityOnly": {
            "type": "boolean"
          },
          "server": {
            "type": "string"
          },
          "servicesOnServer": {
            "format": "int64",
            "type": "integer"
          },
          "stale": {
            "type": "boolean"
          },
          "updates": {
            "description": "Packages that would be upgraded",
            "format": "int64",
            "type": "integer"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "server",
          "manager",
          "securityOnly",
          "updates",
          "security",
          "packages",
          "risks",
          "rebootLikely",
          "restartsDocker",
          "servicesOnServer",
          "productionServices",
          "controlPlane",
          "requiresAcknowledgement",
          "confirm",
          "warnings",
          "checkedAt",
          "stale",
          "ready"
        ],
        "type": "object"
      },
      "PatchRisk": {
        "additionalProperties": false,
        "properties": {
          "package": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "reboot": {
            "description": "The upgrade only takes full effect after a reboot",
            "type": "boolean"
          }
        },
        "required": [
          "package",
          "reason",
          "reboot"
        ],
        "type": "object"
      },
      "PatchRun": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "enum": [
              "check",
              "apply",
              "reboot"
            ],
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "exitCode": {
            "description": "The package manager's exit status (upgrades only)",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "log": {
            "description": "The tail of what the package manager printed (upgrades only; only in the single-run read)",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "rebootingSince": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "requestedBy": {
            "description": "The person who started the run; absent for automatic checks",
            "type": "string"
          },
          "securityOnly": {
            "type": "boolean"
          },
          "status": {
            "description": "rebooting: the host accepted the reboot and NebulaCtrl waits for the agent to reconnect on a new boot",
            "enum": [
              "pending",
              "rebooting",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "scheduled",
              "manual"
            ],
            "type": "string"
          },
          "updatesAfter": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "updatesBefore": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "action",
          "trigger",
          "status",
          "securityOnly",
          "updatesBefore",
          "updatesAfter",
          "exitCode",
          "createdAt",
          "rebootingSince",
          "finishedAt"
        ],
        "type": "object"
      },
      "PatchScheduleInputBody": {
        "additionalProperties": false,
        "properties": {
          "cron": {
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "retentionCount": {
            "format": "int64",
            "maximum": 1000,
            "minimum": 0,
            "type": "integer"
          },
          "retentionDays": {
            "format": "int64",
            "maximum": 3650,
            "minimum": 0,
            "type": "integer"
          },
          "timezone": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchTaskInputBody": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "concurrency": {
            "enum": [
              "forbid",
              "allow"
            ],
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          },
          "schedule": {
            "type": "string"
          },
          "timeoutSeconds": {
            "format": "int64",
            "maximum": 86400,
            "minimum": 1,
            "type": "integer"
          },
          "timezone": {
            "description": "IANA zone; changing it recomputes the next run.",
            "maxLength": 64,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PatchView": {
        "additionalProperties": false,
        "properties": {
          "agentSupported": {
            "description": "The agent advertised patching support; false means update the agent first",
            "type": "boolean"
          },
          "busy": {
            "description": "The run in flight, if any",
            "enum": [
              "check",
              "apply",
              "reboot",
              ""
            ],
            "type": "string"
          },
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "controlPlane": {
            "description": "This server runs the control plane: upgrades and reboots take the dashboard down",
            "type": "boolean"
          },
          "known": {
            "description": "A check has completed at least once",
            "type": "boolean"
          },
          "manager": {
            "description": "Empty until the first check",
            "enum": [
              "apt",
              "dnf",
              ""
            ],
            "type": "string"
          },
          "message": {
            "description": "A caution from the last check",
            "type": "string"
          },
          "online": {
            "type": "boolean"
          },
          "packages": {
            "description": "Pending upgrades, security first, at most 200",
            "items": {
              "$ref": "#/components/schemas/PatchPackage"
            },
            "type": "array"
          },
          "productionServices": {
            "items": {
              "$ref": "#/components/schemas/ProductionService"
            },
            "type": "array"
          },
          "rebootPackages": {
            "description": "Packages that asked for the reboot, when the host says",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "rebootRequired": {
            "type": "boolean"
          },
          "runs": {
            "description": "The most recent runs, newest first, without logs",
            "items": {
              "$ref": "#/components/schemas/PatchRun"
            },
            "type": "array"
          },
          "security": {
            "description": "How many of the updates are security updates",
            "format": "int64",
            "type": "integer"
          },
          "stale": {
            "description": "The last check is older than 12 hours",
            "type": "boolean"
          },
          "supported": {
            "description": "The host has a supported package manager (apt or dnf)",
            "type": "boolean"
          },
          "updates": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "online",
          "agentSupported",
          "known",
          "supported",
          "manager",
          "updates",
          "security",
          "packages",
          "rebootRequired",
          "rebootPackages",
          "checkedAt",
          "stale",
          "busy",
          "controlPlane",
          "productionServices",
          "runs"
        ],
        "type": "object"
      },
      "PeerView": {
        "additionalProperties": false,
        "properties": {
          "direct": {
            "type": "boolean"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "latencyMs": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "online": {
            "type": "boolean"
          },
          "relay": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "ips",
          "direct",
          "online"
        ],
        "type": "object"
      },
      "PendingChangeCounts": {
        "additionalProperties": false,
        "properties": {
          "settings": {
            "format": "int64",
            "type": "integer"
          },
          "variables": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "variables",
          "settings"
        ],
        "type": "object"
      },
      "PlacementView": {
        "additionalProperties": false,
        "properties": {
          "activeBuilds": {
            "format": "int64",
            "type": "integer"
          },
          "buildServerId": {
            "type": "string"
          },
          "buildServerName": {
            "type": "string"
          },
          "emulated": {
            "type": "boolean"
          },
          "fallback": {
            "type": "boolean"
          },
          "location": {
            "enum": [
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "maxConcurrent": {
            "format": "int64",
            "type": "integer"
          },
          "platform": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "registryHost": {
            "type": "string"
          },
          "registryId": {
            "type": "string"
          },
          "reuse": {
            "type": "boolean"
          },
          "sticky": {
            "type": "boolean"
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/Warning"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "location",
          "buildServerId",
          "buildServerName",
          "registryId",
          "registryHost",
          "platform",
          "reason",
          "sticky",
          "emulated",
          "fallback",
          "reuse",
          "maxConcurrent",
          "activeBuilds",
          "warnings"
        ],
        "type": "object"
      },
      "Plan": {
        "additionalProperties": false,
        "properties": {
          "blocking": {
            "items": {
              "$ref": "#/components/schemas/PlanBlocking"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "changes": {
            "items": {
              "$ref": "#/components/schemas/FieldChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "mesh": {
            "$ref": "#/components/schemas/MeshPlan"
          },
          "placement": {
            "$ref": "#/components/schemas/PlacementView"
          },
          "reasons": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "server": {
            "$ref": "#/components/schemas/ServerRef"
          },
          "source": {
            "$ref": "#/components/schemas/PlanSource"
          },
          "strategy": {
            "enum": [
              "rolling",
              "recreate",
              "route_only"
            ],
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "strategy",
          "reasons",
          "warnings",
          "changes",
          "source",
          "server",
          "blocking",
          "placement",
          "mesh"
        ],
        "type": "object"
      },
      "PlanBlocking": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "violations": {
            "items": {
              "$ref": "#/components/schemas/Violation"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "PlanInputBody": {
        "additionalProperties": false,
        "properties": {
          "ports": {
            "$ref": "#/components/schemas/PortsStruct1",
            "description": "Preview a proxy ports setting without staging it"
          },
          "reprovision": {
            "description": "Delete the managed node and register it again with a new key",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "PlanInputBody1": {
        "additionalProperties": false,
        "properties": {
          "targetServerId": {
            "description": "Send every service to this server; omit to pick the online server with the most free memory per service",
            "type": "string"
          }
        },
        "type": "object"
      },
      "PlanLog": {
        "additionalProperties": false,
        "properties": {
          "level": {
            "type": "string"
          },
          "msg": {
            "type": "string"
          }
        },
        "required": [
          "level",
          "msg"
        ],
        "type": "object"
      },
      "PlanMove": {
        "additionalProperties": false,
        "properties": {
          "blocking": {
            "items": {
              "$ref": "#/components/schemas/PlanBlocking"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "environmentName": {
            "type": "string"
          },
          "projectName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "stateful": {
            "description": "The service has volumes or is a database",
            "type": "boolean"
          },
          "targetServerId": {
            "type": "string"
          },
          "targetServerName": {
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceId",
          "serviceName",
          "projectName",
          "environmentName",
          "targetServerId",
          "targetServerName",
          "stateful",
          "warnings",
          "blocking"
        ],
        "type": "object"
      },
      "PlanSource": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "type": "string"
          },
          "commitSha": {
            "type": "string"
          },
          "gitUrl": {
            "type": "string"
          },
          "image": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "PlatformBackupView": {
        "additionalProperties": false,
        "properties": {
          "configured": {
            "type": "boolean"
          },
          "destinationId": {
            "type": "string"
          },
          "destinationName": {
            "type": "string"
          },
          "hint": {
            "type": "string"
          }
        },
        "required": [
          "configured"
        ],
        "type": "object"
      },
      "PlatformCredential": {
        "additionalProperties": false,
        "properties": {
          "label": {
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "label",
          "value",
          "secret"
        ],
        "type": "object"
      },
      "PlatformKindView": {
        "additionalProperties": false,
        "properties": {
          "agpl": {
            "description": "True when the upstream licence is the AGPL (shown in the UI; NebulaCtrl runs the unmodified image as a separate container).",
            "type": "boolean"
          },
          "egress": {
            "description": "Needs outbound internet. Everything else starts with outbound access blocked.",
            "type": "boolean"
          },
          "footprint": {
            "description": "Rough resource use.",
            "type": "string"
          },
          "holdsData": {
            "description": "Has a data volume worth backing up.",
            "type": "boolean"
          },
          "image": {
            "description": "The pinned image.",
            "type": "string"
          },
          "instance": {
            "$ref": "#/components/schemas/PlatformServiceView"
          },
          "instanceAdminOnly": {
            "description": "Changes instance-wide settings: only instance administrators can set it up.",
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "s3",
              "loki",
              "grafana",
              "headscale",
              "idp",
              "registry"
            ],
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "license": {
            "description": "SPDX identifier of the upstream licence.",
            "type": "string"
          },
          "licenseNote": {
            "type": "string"
          },
          "notice": {
            "description": "Caveat shown before setting it up.",
            "type": "string"
          },
          "product": {
            "description": "The software that runs.",
            "type": "string"
          },
          "requires": {
            "description": "Another kind that must be ready first (Grafana needs Loki).",
            "type": "string"
          },
          "sameServer": {
            "description": "The service is placed on the server of the kind it requires.",
            "type": "boolean"
          },
          "summary": {
            "description": "What it is for and what Set up for me wires.",
            "type": "string"
          },
          "variants": {
            "description": "The products that can run this kind; the first is the default.",
            "items": {
              "$ref": "#/components/schemas/PlatformVariantInfo"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "kind",
          "label",
          "product",
          "summary",
          "image",
          "license",
          "agpl",
          "sameServer",
          "footprint",
          "holdsData",
          "egress",
          "instanceAdminOnly"
        ],
        "type": "object"
      },
      "PlatformListing": {
        "additionalProperties": false,
        "properties": {
          "kinds": {
            "items": {
              "$ref": "#/components/schemas/PlatformKindView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "projectId": {
            "type": "string"
          }
        },
        "required": [
          "kinds"
        ],
        "type": "object"
      },
      "PlatformProvisionBody": {
        "additionalProperties": false,
        "properties": {
          "initialPassword": {
            "description": "Shown once; reset it from the people list if lost.",
            "type": "string"
          },
          "initialUser": {
            "type": "string"
          },
          "service": {
            "$ref": "#/components/schemas/PlatformServiceView"
          }
        },
        "required": [
          "service"
        ],
        "type": "object"
      },
      "PlatformServiceRef": {
        "additionalProperties": false,
        "properties": {
          "health": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "state": {
            "enum": [
              "running",
              "starting",
              "stopped",
              "staged",
              "not_deployed",
              "missing"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "state"
        ],
        "type": "object"
      },
      "PlatformServiceView": {
        "additionalProperties": false,
        "properties": {
          "backup": {
            "$ref": "#/components/schemas/PlatformBackupView"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "details": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "environmentSlug": {
            "type": "string"
          },
          "hostname": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "s3",
              "loki",
              "grafana",
              "headscale",
              "idp",
              "registry"
            ],
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "message": {
            "description": "What is happening or why it failed.",
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "publicUrl": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/PlatformServiceRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "status": {
            "enum": [
              "provisioning",
              "ready",
              "failed",
              "removing"
            ],
            "type": "string"
          },
          "step": {
            "enum": [
              "configure",
              "deploy",
              "await",
              "wire",
              "done"
            ],
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "users": {
            "items": {
              "$ref": "#/components/schemas/PlatformUserView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "variant": {
            "enum": [
              "pocketid",
              "authelia"
            ],
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "wiring": {
            "$ref": "#/components/schemas/PlatformWiringView"
          }
        },
        "required": [
          "id",
          "kind",
          "label",
          "status",
          "step",
          "message",
          "hostname",
          "publicUrl",
          "services",
          "details",
          "warnings",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "PlatformUserChange": {
        "additionalProperties": false,
        "properties": {
          "applying": {
            "description": "The change is being deployed (the sign-in page restarts for a few seconds).",
            "type": "boolean"
          },
          "generatedPassword": {
            "description": "Shown once.",
            "type": "string"
          },
          "user": {
            "$ref": "#/components/schemas/PlatformUserView"
          },
          "warning": {
            "type": "string"
          }
        },
        "required": [
          "user",
          "applying"
        ],
        "type": "object"
      },
      "PlatformUserView": {
        "additionalProperties": false,
        "properties": {
          "displayName": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "required": [
          "username",
          "displayName",
          "email"
        ],
        "type": "object"
      },
      "PlatformVar": {
        "additionalProperties": false,
        "properties": {
          "category": {
            "enum": [
              "release",
              "release-self",
              "deployment",
              "container"
            ],
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "referenceable": {
            "type": "boolean"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "value",
          "description",
          "category",
          "referenceable"
        ],
        "type": "object"
      },
      "PlatformVariantInfo": {
        "additionalProperties": false,
        "properties": {
          "egress": {
            "description": "Needs outbound internet.",
            "type": "boolean"
          },
          "footprint": {
            "type": "string"
          },
          "holdsData": {
            "type": "boolean"
          },
          "id": {
            "enum": [
              "pocketid",
              "authelia"
            ],
            "type": "string"
          },
          "image": {
            "description": "The pinned image.",
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "license": {
            "description": "SPDX identifier of the upstream licence.",
            "type": "string"
          },
          "managesUsers": {
            "description": "NebulaCtrl manages the people (Authelia). False when people are managed in the product itself (Pocket ID).",
            "type": "boolean"
          },
          "notice": {
            "type": "string"
          },
          "product": {
            "type": "string"
          },
          "recommended": {
            "description": "The preferred product: the set-up dialog preselects it.",
            "type": "boolean"
          },
          "summary": {
            "type": "string"
          },
          "tagline": {
            "description": "One line that says how people sign in and who manages them.",
            "type": "string"
          }
        },
        "required": [
          "id",
          "label",
          "product",
          "tagline",
          "summary",
          "image",
          "license",
          "footprint",
          "holdsData",
          "egress",
          "managesUsers",
          "recommended"
        ],
        "type": "object"
      },
      "PlatformWiringView": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "enum": [
              "backup_destination",
              "log_drain",
              "tailscale_integration",
              "sign_in_provider"
            ],
            "type": "string"
          }
        },
        "required": [
          "type",
          "id",
          "name"
        ],
        "type": "object"
      },
      "PortView": {
        "additionalProperties": false,
        "properties": {
          "deployed": {
            "description": "false while the route is staged and not yet published by the proxy",
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "projectId": {
            "type": "string"
          },
          "protocol": {
            "enum": [
              "tcp",
              "udp"
            ],
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "description": "Empty when the holder belongs to a project the caller cannot see",
            "type": "string"
          }
        },
        "required": [
          "protocol",
          "port",
          "serviceId",
          "serviceName",
          "deployed",
          "projectId"
        ],
        "type": "object"
      },
      "PortsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PortView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "PortsStruct": {
        "additionalProperties": false,
        "properties": {
          "http": {
            "description": "HTTP host port of the proxy; 0 resets it to the agent's own port (instance administrator)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "https": {
            "description": "HTTPS host port of the proxy (tcp and udp); 0 resets it to the agent's own port (instance administrator)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "PortsStruct1": {
        "additionalProperties": false,
        "properties": {
          "http": {
            "description": "Plan with this HTTP host port (0 = the agent's own)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "https": {
            "description": "Plan with this HTTPS host port (0 = the agent's own)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "Pos": {
        "additionalProperties": false,
        "properties": {
          "x": {
            "format": "double",
            "type": "number"
          },
          "y": {
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "x",
          "y"
        ],
        "type": "object"
      },
      "PreUpgradeBackupView": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "fromVersion": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "status": {
            "enum": [
              "succeeded",
              "failed",
              "skipped",
              "forced"
            ],
            "type": "string"
          },
          "toVersion": {
            "type": "string"
          }
        },
        "required": [
          "at",
          "status"
        ],
        "type": "object"
      },
      "PreviewInputBody": {
        "additionalProperties": false,
        "properties": {
          "count": {
            "description": "How many upcoming runs to return (default 5).",
            "format": "int64",
            "maximum": 20,
            "minimum": 0,
            "type": "integer"
          },
          "schedule": {
            "maxLength": 200,
            "type": "string"
          },
          "timezone": {
            "description": "IANA zone the schedule is evaluated in (default UTC).",
            "maxLength": 64,
            "type": "string"
          }
        },
        "required": [
          "schedule"
        ],
        "type": "object"
      },
      "PreviewSeedCommand": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "maxLength": 2000,
            "minLength": 1,
            "type": "string"
          },
          "runOn": {
            "default": "create",
            "enum": [
              "create",
              "push"
            ],
            "type": "string"
          },
          "service": {
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "service",
          "command",
          "runOn"
        ],
        "type": "object"
      },
      "PreviewSettings": {
        "additionalProperties": false,
        "properties": {
          "baseEnvironmentId": {
            "type": [
              "string",
              "null"
            ]
          },
          "enabled": {
            "type": "boolean"
          },
          "excludedServices": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "forkPrs": {
            "type": "boolean"
          },
          "idleDays": {
            "format": "int64",
            "type": "integer"
          },
          "maxConcurrent": {
            "format": "int64",
            "type": "integer"
          },
          "projectId": {
            "type": "string"
          },
          "seedCommands": {
            "items": {
              "$ref": "#/components/schemas/PreviewSeedCommand"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "updatedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "projectId",
          "enabled",
          "baseEnvironmentId",
          "forkPrs",
          "maxConcurrent",
          "idleDays",
          "seedCommands",
          "excludedServices",
          "updatedAt"
        ],
        "type": "object"
      },
      "PreviewView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "environmentSlug": {
            "type": "string"
          },
          "fromFork": {
            "type": "boolean"
          },
          "headBranch": {
            "type": "string"
          },
          "headSha": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastPushAt": {
            "format": "date-time",
            "type": "string"
          },
          "pausedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "prAuthor": {
            "type": "string"
          },
          "prNumber": {
            "format": "int64",
            "type": "integer"
          },
          "prTitle": {
            "type": "string"
          },
          "prUrl": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "provider": {
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "status": {
            "enum": [
              "creating",
              "deploying",
              "seeding",
              "ready",
              "failed",
              "paused",
              "deleting"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "urls": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "id",
          "projectId",
          "environmentId",
          "environmentSlug",
          "status",
          "statusMessage",
          "provider",
          "repo",
          "prNumber",
          "prTitle",
          "prAuthor",
          "prUrl",
          "headBranch",
          "headSha",
          "fromFork",
          "urls",
          "createdAt",
          "lastPushAt",
          "pausedAt"
        ],
        "type": "object"
      },
      "PrincipalBody": {
        "additionalProperties": false,
        "properties": {
          "label": {
            "type": "string"
          },
          "projectIds": {
            "description": "Absent when the principal can access all projects",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "description": "The caller's role in the current team (the creator's role for tokens); absent without a team",
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "tokenId": {
            "type": "string"
          },
          "type": {
            "enum": [
              "user",
              "token",
              "mcp"
            ],
            "type": "string"
          }
        },
        "required": [
          "type",
          "label",
          "scopes"
        ],
        "type": "object"
      },
      "Problem": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "ProductionService": {
        "additionalProperties": false,
        "properties": {
          "environment": {
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "project": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "name",
          "environmentId",
          "environment",
          "projectId",
          "project"
        ],
        "type": "object"
      },
      "Project": {
        "additionalProperties": false,
        "properties": {
          "buildLocation": {
            "enum": [
              "inherit",
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "buildServerId": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "registryId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "system": {
            "type": "boolean"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "description",
          "system",
          "createdAt",
          "updatedAt",
          "buildLocation",
          "buildServerId",
          "registryId"
        ],
        "type": "object"
      },
      "PromoteConsumer": {
        "additionalProperties": false,
        "properties": {
          "devicesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "keys": {
            "description": "Variables that reference the old primary; they are rewritten as staged changes",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/Problem"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceId",
          "slug",
          "keys",
          "devicesAdded",
          "warnings"
        ],
        "type": "object"
      },
      "PromoteInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptDataLoss": {
            "description": "Required for a forced promote: what the replica had not received is lost",
            "type": "boolean"
          },
          "confirm": {
            "description": "Must equal the replica's slug",
            "type": "string"
          },
          "dryRun": {
            "description": "Only return the plan",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "PromoteOldPrimary": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug"
        ],
        "type": "object"
      },
      "PromotePlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "$ref": "#/components/schemas/Problem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "consumers": {
            "items": {
              "$ref": "#/components/schemas/PromoteConsumer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "dataLossWarning": {
            "type": "string"
          },
          "lagBytes": {
            "format": "int64",
            "type": "integer"
          },
          "lagObservedAt": {
            "format": "date-time",
            "type": "string"
          },
          "mode": {
            "enum": [
              "switchover",
              "forced"
            ],
            "type": "string"
          },
          "oldPrimary": {
            "$ref": "#/components/schemas/PromoteOldPrimary"
          },
          "rebuildReplicas": {
            "items": {
              "$ref": "#/components/schemas/ServiceRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "replica": {
            "$ref": "#/components/schemas/ServiceRef"
          },
          "schedulesMoving": {
            "format": "int64",
            "type": "integer"
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/Problem"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "mode",
          "replica",
          "oldPrimary",
          "consumers",
          "rebuildReplicas",
          "schedulesMoving",
          "blockers",
          "warnings"
        ],
        "type": "object"
      },
      "PromoteResult": {
        "additionalProperties": false,
        "properties": {
          "dryRun": {
            "type": "boolean"
          },
          "plan": {
            "$ref": "#/components/schemas/PromotePlan"
          },
          "promotionId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "dryRun",
          "plan"
        ],
        "type": "object"
      },
      "PromotionView": {
        "additionalProperties": false,
        "properties": {
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "mode": {
            "enum": [
              "switchover",
              "forced"
            ],
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "running",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "step": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "step",
          "mode",
          "message",
          "startedAt"
        ],
        "type": "object"
      },
      "ProposedVariable": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "recommended": {
            "description": "Part of the one-click recommended set",
            "type": "boolean"
          },
          "secret": {
            "description": "The reference resolves to a secret value",
            "type": "boolean"
          },
          "status": {
            "description": "Only on a link preview: new = the source has no such variable, unchanged = it already holds this reference, replaces = it holds another value",
            "enum": [
              "new",
              "unchanged",
              "replaces"
            ],
            "type": "string"
          },
          "value": {
            "description": "A reference such as ${{postgres.DATABASE_URL}}",
            "type": "string"
          }
        },
        "required": [
          "key",
          "value",
          "recommended",
          "secret"
        ],
        "type": "object"
      },
      "ProviderBody": {
        "additionalProperties": false,
        "properties": {
          "allowedDomains": {
            "description": "Empty allows any verified email",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "clientId": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "issuerUrl": {
            "description": "OIDC issuer; for GitHub an optional Enterprise Server base URL",
            "type": "string"
          },
          "kind": {
            "enum": [
              "oidc",
              "github"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "redirectUri": {
            "description": "Register this callback URL at the provider",
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "trustMfa": {
            "description": "Skip the local 2FA step when the provider asserts MFA (amr claim)",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "kind",
          "name",
          "issuerUrl",
          "clientId",
          "scopes",
          "allowedDomains",
          "trustMfa",
          "enabled",
          "redirectUri",
          "createdAt"
        ],
        "type": "object"
      },
      "ProviderInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowedDomains": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "clientId": {
            "maxLength": 500,
            "minLength": 1,
            "type": "string"
          },
          "clientSecret": {
            "description": "Write-only. Required on create; empty on update keeps the stored secret",
            "maxLength": 2000,
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "description": "Create only: the ID the provider gets, so its callback URL (/api/v1/auth/oidc/{id}/callback) can be registered at the identity provider before saving. Generated when omitted; 409 provider_id_taken when in use",
            "type": "string"
          },
          "issuerUrl": {
            "maxLength": 500,
            "type": "string"
          },
          "kind": {
            "enum": [
              "oidc",
              "github"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "trustMfa": {
            "type": "boolean"
          }
        },
        "required": [
          "kind",
          "name",
          "clientId"
        ],
        "type": "object"
      },
      "ProvidersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "providers": {
            "items": {
              "$ref": "#/components/schemas/PublicProviderBody"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "providers"
        ],
        "type": "object"
      },
      "ProvidersOutputBody1": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DNSProviderSpec"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ProvisionInputBody": {
        "additionalProperties": false,
        "properties": {
          "bucket": {
            "description": "S3: the bucket (default nebulactrl-backups).",
            "maxLength": 63,
            "type": "string"
          },
          "hostname": {
            "description": "Public hostname; default a generated one under the server's base domain, else \u003cip\u003e.sslip.io.",
            "maxLength": 253,
            "type": "string"
          },
          "kind": {
            "description": "Which platform service to set up. registry: the managed container registry for build servers.",
            "enum": [
              "s3",
              "loki",
              "grafana",
              "headscale",
              "idp",
              "registry"
            ],
            "type": "string"
          },
          "providerName": {
            "description": "Single sign-on: the label of the sign-in button (default NebulaCtrl SSO).",
            "maxLength": 60,
            "type": "string"
          },
          "publicUrl": {
            "description": "Overrides https://\u003chostname\u003e: a proxy on a non-standard port, or plain http for a local test.",
            "maxLength": 300,
            "type": "string"
          },
          "replace": {
            "description": "Headscale: replace an existing Tailscale integration.",
            "type": "boolean"
          },
          "retentionDays": {
            "description": "Loki: how long logs are kept (default 14).",
            "format": "int64",
            "maximum": 3650,
            "minimum": 0,
            "type": "integer"
          },
          "serverId": {
            "description": "The server it runs on (Grafana always runs next to Loki).",
            "type": "string"
          },
          "variant": {
            "description": "Single sign-on: the product. pocketid (default): passkeys only, people managed in Pocket ID. authelia: password + 2FA, NebulaCtrl manages the people.",
            "enum": [
              "pocketid",
              "authelia"
            ],
            "type": "string"
          }
        },
        "required": [
          "kind"
        ],
        "type": "object"
      },
      "Proxy": {
        "additionalProperties": false,
        "properties": {
          "appliedGeneration": {
            "description": "Generation the last successful proxy deploy applied; behind Generation means staged changes",
            "format": "int64",
            "type": "integer"
          },
          "error": {
            "type": "string"
          },
          "generation": {
            "description": "Bumped by every staged server-level proxy change",
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "description": "ok, starting, error, or empty before the first heartbeat",
            "type": "string"
          },
          "tailnet": {
            "$ref": "#/components/schemas/ServerTailnetSummary"
          },
          "v2": {
            "description": "The agent advertises proxy.v2 (domain options, external routes, TCP/UDP, certificates, tailnet)",
            "type": "boolean"
          }
        },
        "required": [
          "status",
          "v2",
          "generation",
          "appliedGeneration",
          "tailnet"
        ],
        "type": "object"
      },
      "ProxyDeployInfo": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          },
          "endedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "sent",
              "acked",
              "succeeded",
              "failed",
              "expired",
              "canceled"
            ],
            "type": "string"
          }
        },
        "required": [
          "commandId",
          "status",
          "message",
          "startedAt",
          "endedAt"
        ],
        "type": "object"
      },
      "ProxyDeployResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "plan": {
            "$ref": "#/components/schemas/ProxyPlan"
          }
        },
        "required": [
          "commandId",
          "generation",
          "plan"
        ],
        "type": "object"
      },
      "ProxyL4Port": {
        "additionalProperties": false,
        "properties": {
          "deployed": {
            "description": "False while the route service has no current deployment (the port is reserved but not listening)",
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "enum": [
              "tcp",
              "udp"
            ],
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          }
        },
        "required": [
          "protocol",
          "port",
          "serviceId",
          "serviceName",
          "deployed"
        ],
        "type": "object"
      },
      "ProxyPlan": {
        "additionalProperties": false,
        "properties": {
          "diff": {
            "items": {
              "$ref": "#/components/schemas/ProxyPlanChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "reasons": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restartRequired": {
            "description": "The proxy container is recreated (about 1 second of dropped connections)",
            "type": "boolean"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "restartRequired",
          "reasons",
          "warnings",
          "diff"
        ],
        "type": "object"
      },
      "ProxyPlanChange": {
        "additionalProperties": false,
        "properties": {
          "field": {
            "type": "string"
          },
          "from": {
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "field",
          "from",
          "to"
        ],
        "type": "object"
      },
      "ProxyPorts": {
        "additionalProperties": false,
        "properties": {
          "agentHttp": {
            "description": "The HTTP port of the agent's own flags (what Reset to agent defaults returns to)",
            "format": "int64",
            "type": "integer"
          },
          "agentHttps": {
            "description": "The HTTPS port of the agent's own flags",
            "format": "int64",
            "type": "integer"
          },
          "appliedHttp": {
            "description": "HTTP host port the proxy listens on now (as reported by the agent)",
            "format": "int64",
            "type": "integer"
          },
          "appliedHttps": {
            "description": "HTTPS host port the proxy listens on now",
            "format": "int64",
            "type": "integer"
          },
          "busyOther": {
            "description": "Of ports 80 and 443, those another process holds right now (reported by the agent)",
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "http": {
            "description": "HTTP host port the proxy will listen on after Deploy proxy (the setting, else the agent's own port)",
            "format": "int64",
            "type": "integer"
          },
          "https": {
            "description": "HTTPS host port (tcp and udp) the proxy will listen on after Deploy proxy",
            "format": "int64",
            "type": "integer"
          },
          "reported": {
            "description": "The agent has reported its ports",
            "type": "boolean"
          },
          "setHttp": {
            "description": "The staged HTTP port setting; null = the agent's own port",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "setHttps": {
            "description": "The staged HTTPS port setting; null = the agent's own port",
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "source": {
            "description": "Where the ports the proxy runs on come from: flag = the agent's own service flags (--proxy-http-port, --proxy-https-port), server = the server setting; empty until the agent reports",
            "enum": [
              "",
              "flag",
              "server"
            ],
            "type": "string"
          },
          "staged": {
            "description": "The ports setting differs from the applied one and awaits Deploy proxy",
            "type": "boolean"
          },
          "supported": {
            "description": "The agent can change its ports from the server (capability proxy.ports)",
            "type": "boolean"
          }
        },
        "required": [
          "http",
          "https",
          "appliedHttp",
          "appliedHttps",
          "source",
          "staged",
          "setHttp",
          "setHttps",
          "agentHttp",
          "agentHttps",
          "busyOther",
          "reported",
          "supported"
        ],
        "type": "object"
      },
      "ProxyRoute": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "denyCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hosts": {
            "items": {
              "$ref": "#/components/schemas/ProxyRouteHost"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "kind": {
            "enum": [
              "service",
              "external"
            ],
            "type": "string"
          },
          "listenPort": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "enum": [
              "http",
              "tcp",
              "udp"
            ],
            "type": "string"
          },
          "proxyProtocol": {
            "format": "int64",
            "type": "integer"
          },
          "serviceId": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "upstreams": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceId",
          "serviceName",
          "protocol",
          "kind",
          "hosts",
          "upstreams",
          "allowCidrs",
          "denyCidrs"
        ],
        "type": "object"
      },
      "ProxyRouteHost": {
        "additionalProperties": false,
        "properties": {
          "accessList": {
            "description": "An IP allowlist is set",
            "type": "boolean"
          },
          "basicAuth": {
            "type": "boolean"
          },
          "certificateId": {
            "type": "string"
          },
          "host": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "serve",
              "redirect"
            ],
            "type": "string"
          },
          "pathPrefix": {
            "type": "string"
          },
          "rateLimit": {
            "type": "boolean"
          },
          "redirectTo": {
            "type": "string"
          },
          "tlsMode": {
            "enum": [
              "auto",
              "custom",
              "none"
            ],
            "type": "string"
          }
        },
        "required": [
          "host",
          "pathPrefix",
          "kind",
          "tlsMode",
          "basicAuth",
          "accessList",
          "rateLimit"
        ],
        "type": "object"
      },
      "ProxyTailnet": {
        "additionalProperties": false,
        "properties": {
          "appliedMode": {
            "enum": [
              "off",
              "managed",
              "host"
            ],
            "type": "string"
          },
          "hostTailscale": {
            "$ref": "#/components/schemas/HostTailscale"
          },
          "hostname": {
            "description": "Desired machine name of the managed node",
            "type": "string"
          },
          "integrationConfigured": {
            "type": "boolean"
          },
          "magicDns": {
            "type": "boolean"
          },
          "mode": {
            "description": "Desired mode (staged until Deploy proxy)",
            "enum": [
              "off",
              "managed",
              "host"
            ],
            "type": "string"
          },
          "status": {
            "$ref": "#/components/schemas/TailnetStatus",
            "description": "Observed state reported by the agent; absent when never reported"
          },
          "statusAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "mode",
          "appliedMode",
          "hostname",
          "magicDns",
          "hostTailscale",
          "integrationConfigured"
        ],
        "type": "object"
      },
      "ProxyUpstreamPolicy": {
        "additionalProperties": false,
        "properties": {
          "allowHostGateway": {
            "description": "Resolve host.docker.internal to the Docker host from the proxy container",
            "type": "boolean"
          },
          "allowLinkLocal": {
            "description": "Allow link-local addresses incl. cloud metadata 169.254.169.254 (administrators only)",
            "type": "boolean"
          },
          "allowLoopback": {
            "description": "Allow external upstreams on 127.0.0.0/8 and localhost (administrators only)",
            "type": "boolean"
          }
        },
        "required": [
          "allowLoopback",
          "allowLinkLocal",
          "allowHostGateway"
        ],
        "type": "object"
      },
      "PruneVolumesInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirm": {
            "description": "The server's name, typed to confirm",
            "type": "string"
          }
        },
        "required": [
          "confirm"
        ],
        "type": "object"
      },
      "PublicConnection": {
        "additionalProperties": false,
        "properties": {
          "expiresAt": {
            "description": "The value is meant to be shown for this long only; clients must not persist it",
            "format": "date-time",
            "type": "string"
          },
          "host": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "revealedAt": {
            "format": "date-time",
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "value",
          "host",
          "port",
          "revealedAt",
          "expiresAt"
        ],
        "type": "object"
      },
      "PublicConnectionInputBody": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "description": "One of the database's exports; defaults to the engine's connection URL (DATABASE_URL, REDIS_URL, MONGO_URL)",
            "maxLength": 64,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PublicPortView": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "denyCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deployed": {
            "description": "The proxy publishes the port",
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "host": {
            "description": "The address clients connect to (the server's public IP); empty when the server has none",
            "type": "string"
          },
          "listenPort": {
            "format": "int64",
            "type": "integer"
          },
          "newEntrypoint": {
            "description": "The proxy does not listen on this port yet: applying it recreates the proxy container (about a second of dropped connections)",
            "type": "boolean"
          },
          "openToAll": {
            "description": "The allow-list admits every address (confirmed with the database slug)",
            "type": "boolean"
          },
          "routeId": {
            "description": "The route service that holds the port",
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "staged": {
            "description": "The route has changes that are not deployed yet",
            "type": "boolean"
          },
          "suggestedPort": {
            "description": "A free port to start from when enabling",
            "format": "int64",
            "type": "integer"
          },
          "tls": {
            "description": "The proxy never terminates TLS on this port",
            "enum": [
              "passthrough"
            ],
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "enabled",
          "suggestedPort",
          "allowCidrs",
          "denyCidrs",
          "openToAll",
          "staged",
          "deployed",
          "newEntrypoint",
          "tls",
          "warnings"
        ],
        "type": "object"
      },
      "PublicProviderBody": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "oidc",
              "github"
            ],
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "kind"
        ],
        "type": "object"
      },
      "PutInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowedTags": {
            "description": "Tags NebulaCtrl may use; must include every default tag",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "clientId": {
            "description": "OAuth client id (tailscale_oauth only)",
            "maxLength": 200,
            "type": "string"
          },
          "clientSecret": {
            "description": "Write-only: the OAuth client secret, the Headscale API key or the Headscale pre-auth key. Omit to keep the stored secret.",
            "maxLength": 512,
            "type": "string"
          },
          "defaultTags": {
            "description": "Tags minted keys carry (default tag:nebula-svc)",
            "items": {
              "type": "string"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          },
          "headscaleCredential": {
            "description": "apikey: NebulaCtrl mints single-use pre-auth keys and deletes nodes; preauth: one reusable tagged pre-auth key (headscale only)",
            "enum": [
              "apikey",
              "preauth"
            ],
            "type": "string"
          },
          "headscaleUser": {
            "description": "Headscale user that owns minted pre-auth keys; empty creates tags-only keys (headscale only)",
            "maxLength": 128,
            "type": "string"
          },
          "loginServer": {
            "description": "Headscale control URL (headscale only)",
            "maxLength": 300,
            "type": "string"
          },
          "provider": {
            "description": "tailscale_oauth (default) or headscale",
            "enum": [
              "tailscale_oauth",
              "headscale"
            ],
            "type": "string"
          },
          "tailnet": {
            "description": "Tailnet name; empty or - uses the tailnet of the OAuth client",
            "maxLength": 128,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PutInputBody1": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "description": "Account used for Cloudflare Tunnel calls; defaults to the account of the token's zones",
            "maxLength": 64,
            "type": "string"
          },
          "autoManage": {
            "description": "New domains in a connected zone get their DNS records managed automatically (default true)",
            "type": "boolean"
          },
          "defaultProxied": {
            "description": "New managed records start proxied (orange cloud; default false)",
            "type": "boolean"
          },
          "dns01CredentialId": {
            "description": "Use the token of an existing Cloudflare DNS-01 credential instead of typing one",
            "type": "string"
          },
          "token": {
            "description": "Write-only: a Cloudflare API token with Zone → Zone: Read and Zone → DNS: Edit (add Zone → Zone Settings: Read for SSL-mode warnings and Account → Cloudflare Tunnel: Edit for tunnels). Omit to keep the stored token.",
            "maxLength": 512,
            "type": "string"
          }
        },
        "type": "object"
      },
      "PutInputBody2": {
        "additionalProperties": false,
        "properties": {
          "variables": {
            "items": {
              "$ref": "#/components/schemas/VariableInput"
            },
            "maxItems": 500,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "variables"
        ],
        "type": "object"
      },
      "PutInputBody3": {
        "additionalProperties": false,
        "properties": {
          "layout": {
            "$ref": "#/components/schemas/Layout"
          }
        },
        "required": [
          "layout"
        ],
        "type": "object"
      },
      "PutSettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "capture": {
            "type": "boolean"
          },
          "maxServerBytes": {
            "format": "int64",
            "minimum": 33554432,
            "type": "integer"
          },
          "maxServiceBytes": {
            "format": "int64",
            "minimum": 33554432,
            "type": "integer"
          },
          "retentionDays": {
            "format": "int64",
            "maximum": 90,
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "capture",
          "retentionDays",
          "maxServiceBytes",
          "maxServerBytes"
        ],
        "type": "object"
      },
      "PutSettingsInputBody1": {
        "additionalProperties": false,
        "properties": {
          "baseEnvironmentId": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "excludedServices": {
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "forkPrs": {
            "type": "boolean"
          },
          "idleDays": {
            "format": "int64",
            "maximum": 365,
            "minimum": 0,
            "type": "integer"
          },
          "maxConcurrent": {
            "format": "int64",
            "maximum": 50,
            "minimum": 0,
            "type": "integer"
          },
          "seedCommands": {
            "items": {
              "$ref": "#/components/schemas/PreviewSeedCommand"
            },
            "maxItems": 20,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "PutTeamSettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "buildLocation": {
            "description": "Where services build by default: on their own server (target) or on a build server.",
            "enum": [
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "registryId": {
            "description": "Default registry builds are pushed to; omitted clears it.",
            "type": "string"
          }
        },
        "required": [
          "buildLocation"
        ],
        "type": "object"
      },
      "RangeInfo": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "format": "date-time",
            "type": "string"
          },
          "retention": {
            "$ref": "#/components/schemas/Retention"
          },
          "stepSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "to": {
            "format": "date-time",
            "type": "string"
          },
          "truncated": {
            "type": "boolean"
          }
        },
        "required": [
          "from",
          "to",
          "stepSeconds",
          "retention",
          "truncated"
        ],
        "type": "object"
      },
      "RateLimit": {
        "additionalProperties": false,
        "properties": {
          "average": {
            "format": "int64",
            "type": "integer"
          },
          "burst": {
            "format": "int64",
            "type": "integer"
          },
          "periodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "trustedProxyDepth": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "average",
          "periodSeconds",
          "burst"
        ],
        "type": "object"
      },
      "RebootInputBody": {
        "additionalProperties": false,
        "properties": {
          "acknowledgeProduction": {
            "description": "Required when production services or the control plane run on the server",
            "type": "boolean"
          },
          "confirm": {
            "description": "The server's name, typed by the person",
            "type": "string"
          }
        },
        "required": [
          "confirm"
        ],
        "type": "object"
      },
      "RebuildInputBody": {
        "additionalProperties": false,
        "properties": {
          "followServiceId": {
            "description": "For a fenced old primary: the new primary to follow (default: the replica that was promoted)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "RebuildResult": {
        "additionalProperties": false,
        "properties": {
          "serviceId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "status"
        ],
        "type": "object"
      },
      "ReconcileInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptMeshChanges": {
            "description": "Confirm the tailnet devices mode add creates; the 409 mesh_confirmation_required response states how many",
            "type": "boolean"
          },
          "mode": {
            "description": "add creates the links the environment needs (devices need acceptMeshChanges); repair only removes grants without a source",
            "enum": [
              "add",
              "repair"
            ],
            "type": "string"
          }
        },
        "required": [
          "mode"
        ],
        "type": "object"
      },
      "ReconcileView": {
        "additionalProperties": false,
        "properties": {
          "added": {
            "items": {
              "$ref": "#/components/schemas/GrantChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "devicesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "mode": {
            "enum": [
              "add",
              "repair"
            ],
            "type": "string"
          },
          "removed": {
            "items": {
              "$ref": "#/components/schemas/GrantChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restaged": {
            "description": "Consumers whose resolved addresses changed; their staged bar shows it",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "waiting": {
            "description": "Grants kept for their grace period",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "mode",
          "added",
          "removed",
          "waiting",
          "devicesAdded",
          "restaged"
        ],
        "type": "object"
      },
      "RecordView": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "type": "string"
          },
          "owned": {
            "description": "Created by NebulaCtrl (carries its ownership marker)",
            "type": "boolean"
          },
          "proxied": {
            "type": "boolean"
          },
          "type": {
            "enum": [
              "A",
              "AAAA",
              "CNAME"
            ],
            "type": "string"
          }
        },
        "required": [
          "type",
          "content",
          "proxied",
          "owned"
        ],
        "type": "object"
      },
      "RecoveryCodesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "recoveryCodes": {
            "description": "Single-use codes; shown once",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "recoveryCodes"
        ],
        "type": "object"
      },
      "RecoveryKeyInputBody": {
        "additionalProperties": false,
        "type": "object"
      },
      "Redirect": {
        "additionalProperties": false,
        "properties": {
          "permanent": {
            "type": "boolean"
          },
          "regex": {
            "type": "string"
          },
          "replacement": {
            "type": "string"
          }
        },
        "required": [
          "regex",
          "replacement"
        ],
        "type": "object"
      },
      "RefCheck": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ns": {
            "type": "string"
          },
          "resolved": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "resolved",
          "secret"
        ],
        "type": "object"
      },
      "ReferenceFinding": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ref": {
            "type": "string"
          },
          "service": {
            "type": "string"
          },
          "status": {
            "enum": [
              "unresolved",
              "rebound"
            ],
            "type": "string"
          }
        },
        "required": [
          "service",
          "key",
          "ref",
          "status",
          "message"
        ],
        "type": "object"
      },
      "RefreshResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          }
        },
        "required": [
          "commandId"
        ],
        "type": "object"
      },
      "RegenerateRecoveryCodesInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "A current authenticator code or an unused recovery code",
            "maxLength": 40,
            "type": "string"
          },
          "password": {
            "description": "Instead of a code, for an account that uses passkeys and no authenticator app",
            "maxLength": 256,
            "type": "string"
          }
        },
        "type": "object"
      },
      "RegistryAuthInput": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "maxLength": 4096,
            "type": "string"
          },
          "username": {
            "maxLength": 256,
            "type": "string"
          }
        },
        "required": [
          "username",
          "password"
        ],
        "type": "object"
      },
      "RegistryCheck": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "pending": {
            "description": "The agent has not answered within the wait; read the registry again for the result.",
            "type": "boolean"
          },
          "pull": {
            "type": "boolean"
          },
          "push": {
            "type": "boolean"
          },
          "serverId": {
            "type": "string"
          }
        },
        "required": [
          "ok",
          "push",
          "pull",
          "at"
        ],
        "type": "object"
      },
      "RegistryImagePage": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RegistryImageView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "nextCursor": {
            "type": "string"
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "RegistryImageView": {
        "additionalProperties": false,
        "properties": {
          "digest": {
            "description": "Manifest digest, sha256:…",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "platform": {
            "type": "string"
          },
          "pushedAt": {
            "format": "date-time",
            "type": "string"
          },
          "reference": {
            "description": "The pull reference, host/repository@digest.",
            "type": "string"
          },
          "releaseId": {
            "type": "string"
          },
          "repository": {
            "description": "The repository as recorded when the image was pushed.",
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "sizeBytes": {
            "format": "int64",
            "type": "integer"
          },
          "state": {
            "description": "live: in the rollback window. expired: outside it; a managed registry deletes it at the next sweep. deleted: removed from the registry.",
            "enum": [
              "live",
              "expired",
              "deleted"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "repository",
          "digest",
          "reference",
          "platform",
          "state",
          "pushedAt"
        ],
        "type": "object"
      },
      "RegistryManagedView": {
        "additionalProperties": false,
        "properties": {
          "gcState": {
            "description": "readonly: the weekly garbage-collection window has started and pushes are refused; builds wait.",
            "enum": [
              "idle",
              "readonly",
              "collecting"
            ],
            "type": "string"
          },
          "lastGcAt": {
            "format": "date-time",
            "type": "string"
          },
          "lastGcMessage": {
            "type": "string"
          },
          "lastSweepAt": {
            "format": "date-time",
            "type": "string"
          },
          "lastSweepDeleted": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "enum": [
              "provisioning",
              "ready",
              "failed",
              "removing",
              "missing"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          }
        },
        "required": [
          "status",
          "statusMessage",
          "gcState",
          "lastSweepDeleted"
        ],
        "type": "object"
      },
      "RegistryReferences": {
        "additionalProperties": false,
        "properties": {
          "projects": {
            "description": "Projects that use it.",
            "format": "int64",
            "type": "integer"
          },
          "services": {
            "description": "Services whose build override uses it.",
            "format": "int64",
            "type": "integer"
          },
          "teams": {
            "description": "Team build settings that use it as the default registry.",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "teams",
          "projects",
          "services"
        ],
        "type": "object"
      },
      "RegistryView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "hasPullAuth": {
            "description": "A separate read-only credential is set; targets pull with it. Otherwise they use the push credential.",
            "type": "boolean"
          },
          "hasPushAuth": {
            "type": "boolean"
          },
          "host": {
            "description": "registry.example.com[:port], no scheme.",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "imageCount": {
            "description": "Live images.",
            "format": "int64",
            "type": "integer"
          },
          "inUse": {
            "description": "A team, project or service setting uses it: it cannot be removed.",
            "type": "boolean"
          },
          "insecure": {
            "description": "A loopback host: plain http is used.",
            "type": "boolean"
          },
          "kind": {
            "enum": [
              "external",
              "managed"
            ],
            "type": "string"
          },
          "lastCheck": {
            "additionalProperties": {
              "$ref": "#/components/schemas/RegistryCheck"
            },
            "description": "Result of the last check, by server id.",
            "type": "object"
          },
          "manageRetention": {
            "description": "NebulaCtrl deletes images that fall out of the rollback window (managed registries; opt-in for external).",
            "type": "boolean"
          },
          "managed": {
            "$ref": "#/components/schemas/RegistryManagedView"
          },
          "name": {
            "type": "string"
          },
          "namespace": {
            "type": "string"
          },
          "platformServiceId": {
            "type": "string"
          },
          "pullUsername": {
            "type": "string"
          },
          "pushUsername": {
            "type": "string"
          },
          "references": {
            "$ref": "#/components/schemas/RegistryReferences"
          },
          "sizeBytes": {
            "description": "Space the live images take.",
            "format": "int64",
            "type": "integer"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "host",
          "namespace",
          "hasPushAuth",
          "hasPullAuth",
          "manageRetention",
          "insecure",
          "lastCheck",
          "imageCount",
          "sizeBytes",
          "inUse",
          "references",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "ReleaseDetailView": {
        "additionalProperties": false,
        "properties": {
          "build": {
            "$ref": "#/components/schemas/BuildInfo"
          },
          "config": {},
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "deploymentId": {
            "type": "string"
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "imageRef": {
            "type": "string"
          },
          "placement": {
            "$ref": "#/components/schemas/ReleasePlacement"
          },
          "serviceId": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ReleaseSource"
          },
          "variables": {
            "items": {
              "$ref": "#/components/schemas/ReleaseVariableView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "variablesPruned": {
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "serviceId",
          "deploymentId",
          "generation",
          "createdAt",
          "imageRef",
          "source",
          "build",
          "placement",
          "config",
          "variables",
          "variablesPruned"
        ],
        "type": "object"
      },
      "ReleasePlacement": {
        "additionalProperties": false,
        "properties": {
          "buildServerId": {
            "type": "string"
          },
          "buildServerName": {
            "type": "string"
          },
          "platform": {
            "type": "string"
          },
          "registryId": {
            "type": "string"
          },
          "registryRef": {
            "type": "string"
          },
          "strategy": {
            "type": "string"
          },
          "targetServerId": {
            "type": "string"
          },
          "targetServerName": {
            "type": "string"
          }
        },
        "required": [
          "strategy",
          "targetServerId",
          "targetServerName",
          "buildServerId",
          "buildServerName",
          "registryId",
          "registryRef",
          "platform"
        ],
        "type": "object"
      },
      "ReleaseRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "imageRef": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ReleaseSource"
          }
        },
        "required": [
          "id",
          "imageRef",
          "source"
        ],
        "type": "object"
      },
      "ReleaseSource": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "type": "string"
          },
          "buildHash": {
            "type": "string"
          },
          "builtOn": {
            "type": "string"
          },
          "commitSha": {
            "type": "string"
          },
          "components": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "digest": {
            "type": "string"
          },
          "gitUrl": {
            "type": "string"
          },
          "image": {
            "type": "string"
          },
          "imageId": {
            "type": "string"
          },
          "platform": {
            "type": "string"
          },
          "registryId": {
            "type": "string"
          },
          "registryRef": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "ReleaseVariableView": {
        "additionalProperties": false,
        "properties": {
          "external": {
            "type": "boolean"
          },
          "key": {
            "type": "string"
          },
          "platform": {
            "type": "boolean"
          },
          "reference": {
            "type": "boolean"
          },
          "scope": {
            "enum": [
              "runtime",
              "build",
              "both"
            ],
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "secret",
          "reference",
          "platform",
          "external",
          "scope"
        ],
        "type": "object"
      },
      "ReleaseView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "imageRef": {
            "type": "string"
          },
          "source": {
            "$ref": "#/components/schemas/ReleaseSource"
          }
        },
        "required": [
          "id",
          "imageRef",
          "source",
          "createdAt"
        ],
        "type": "object"
      },
      "RemoveResult": {
        "additionalProperties": false,
        "properties": {
          "serviceId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "status"
        ],
        "type": "object"
      },
      "RenameTeamInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "ReplicaMemberView": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "lagBytes": {
            "format": "int64",
            "type": "integer"
          },
          "message": {
            "type": "string"
          },
          "observedAt": {
            "format": "date-time",
            "type": "string"
          },
          "replayLagMs": {
            "format": "int64",
            "type": "integer"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "state": {
            "description": "pending, preparing, cloning, deploying, streaming, lagging, broken, needs_rebuild, promoting, removing, failed, or unknown (stale observation)",
            "type": "string"
          },
          "walStatus": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug",
          "state",
          "message"
        ],
        "type": "object"
      },
      "ReplicaMetric": {
        "additionalProperties": false,
        "properties": {
          "cpuPercent": {
            "format": "double",
            "type": "number"
          },
          "index": {
            "format": "int64",
            "type": "integer"
          },
          "memBytes": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "index",
          "cpuPercent",
          "memBytes"
        ],
        "type": "object"
      },
      "ReplicaPlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "$ref": "#/components/schemas/Problem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "devicesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "links": {
            "items": {
              "$ref": "#/components/schemas/ReplicaPlanLink"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sameServer": {
            "type": "boolean"
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/Problem"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serverId",
          "serverName",
          "sameServer",
          "devicesAdded",
          "links",
          "blockers",
          "warnings"
        ],
        "type": "object"
      },
      "ReplicaPlanLink": {
        "additionalProperties": false,
        "properties": {
          "from": {
            "type": "string"
          },
          "purpose": {
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "from",
          "to",
          "purpose"
        ],
        "type": "object"
      },
      "ReplicaSpec": {
        "additionalProperties": false,
        "properties": {
          "host": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "primaryServiceId": {
            "type": "string"
          },
          "slot": {
            "type": "string"
          },
          "user": {
            "type": "string"
          }
        },
        "required": [
          "primaryServiceId",
          "host",
          "port",
          "slot",
          "user"
        ],
        "type": "object"
      },
      "ReplicaStateView": {
        "additionalProperties": false,
        "properties": {
          "lagBytes": {
            "format": "int64",
            "type": "integer"
          },
          "message": {
            "type": "string"
          },
          "observedAt": {
            "format": "date-time",
            "type": "string"
          },
          "replayLagMs": {
            "format": "int64",
            "type": "integer"
          },
          "state": {
            "description": "pending, preparing, cloning, deploying, streaming, lagging, broken, needs_rebuild, promoting, removing, failed, or unknown (stale observation)",
            "type": "string"
          },
          "walStatus": {
            "type": "string"
          }
        },
        "required": [
          "state",
          "message"
        ],
        "type": "object"
      },
      "ReplicaView": {
        "additionalProperties": false,
        "properties": {
          "health": {
            "type": "string"
          },
          "index": {
            "description": "0-based replica index.",
            "format": "int64",
            "type": "integer"
          },
          "running": {
            "description": "The replica runs, so a shell or the file browser can attach to it.",
            "type": "boolean"
          },
          "state": {
            "description": "Observed container state: running, exited, restarting, …",
            "type": "string"
          }
        },
        "required": [
          "index",
          "state",
          "running"
        ],
        "type": "object"
      },
      "ReplicationView": {
        "additionalProperties": false,
        "properties": {
          "canPromote": {
            "type": "boolean"
          },
          "primary": {
            "$ref": "#/components/schemas/ServiceRef",
            "description": "The primary a replica follows"
          },
          "promotion": {
            "$ref": "#/components/schemas/PromotionView"
          },
          "rebuildable": {
            "description": "A replica that can be rebuilt, or a fenced old primary that can be rebuilt as a replica",
            "type": "boolean"
          },
          "replicas": {
            "items": {
              "$ref": "#/components/schemas/ReplicaMemberView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "enum": [
              "standalone",
              "primary",
              "replica",
              "fenced"
            ],
            "type": "string"
          },
          "self": {
            "$ref": "#/components/schemas/ReplicaStateView",
            "description": "The viewed service's own replica state (role replica)"
          }
        },
        "required": [
          "role",
          "replicas",
          "rebuildable",
          "canPromote"
        ],
        "type": "object"
      },
      "Repo": {
        "additionalProperties": false,
        "properties": {
          "archived": {
            "type": "boolean"
          },
          "cloneUrl": {
            "type": "string"
          },
          "defaultBranch": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "fullName": {
            "type": "string"
          },
          "htmlUrl": {
            "type": "string"
          },
          "private": {
            "type": "boolean"
          }
        },
        "required": [
          "fullName",
          "cloneUrl",
          "defaultBranch",
          "private",
          "htmlUrl",
          "description",
          "archived"
        ],
        "type": "object"
      },
      "Report": {
        "additionalProperties": false,
        "properties": {
          "activeHours": {
            "items": {
              "items": {
                "format": "int64",
                "type": "integer"
              },
              "type": [
                "array",
                "null"
              ]
            },
            "type": [
              "array",
              "null"
            ]
          },
          "comparison": {
            "$ref": "#/components/schemas/Summary",
            "description": "Same fields for the previous equal window; present with compare=prev"
          },
          "deployments": {
            "items": {
              "$ref": "#/components/schemas/DeploymentMarker"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "geo": {
            "$ref": "#/components/schemas/Geo"
          },
          "geoReason": {
            "description": "Why geo is absent",
            "enum": [
              "geo_disabled",
              "traffic_disabled"
            ],
            "type": "string"
          },
          "notFound": {
            "description": "Most requested paths answered 404",
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "range": {
            "$ref": "#/components/schemas/RangeInfo"
          },
          "series": {
            "items": {
              "$ref": "#/components/schemas/SeriesPoint"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sparklines": {
            "$ref": "#/components/schemas/Sparklines"
          },
          "statusCodes": {
            "items": {
              "$ref": "#/components/schemas/StatusCount"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "summary": {
            "$ref": "#/components/schemas/Summary"
          },
          "topBrowsers": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "topDevices": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "topHosts": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "topOS": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "topPaths": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "topPathsKind": {
            "enum": [
              "pages",
              "requests"
            ],
            "type": "string"
          },
          "topReferrers": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "unrouted": {
            "$ref": "#/components/schemas/Unrouted"
          }
        },
        "required": [
          "range",
          "summary",
          "sparklines",
          "series",
          "deployments",
          "statusCodes",
          "topPathsKind",
          "topPaths",
          "topHosts",
          "topReferrers",
          "topBrowsers",
          "topOS",
          "topDevices",
          "notFound"
        ],
        "type": "object"
      },
      "ReposOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Repo"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ReprovisionResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          }
        },
        "required": [
          "commandId"
        ],
        "type": "object"
      },
      "RequiredTeamBody": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name"
        ],
        "type": "object"
      },
      "ResetInputBody": {
        "additionalProperties": false,
        "properties": {
          "password": {
            "description": "Empty generates one (returned once).",
            "maxLength": 128,
            "type": "string"
          }
        },
        "type": "object"
      },
      "RestagedServiceRef": {
        "additionalProperties": false,
        "properties": {
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "slug"
        ],
        "type": "object"
      },
      "RestoreInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirmSlug": {
            "description": "In-place restores: the database's slug.",
            "type": "string"
          },
          "mode": {
            "default": "new",
            "description": "new: restore into a new sibling database (default, the original is untouched). in_place: overwrite this database after a safety backup.",
            "enum": [
              "new",
              "in_place"
            ],
            "type": "string"
          },
          "name": {
            "description": "Name of the new database (mode new).",
            "type": "string"
          },
          "serverId": {
            "description": "Server for the new database (mode new). A backup stored in a local directory can only be restored on its own server.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "RestoreListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RestoreView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "RestoreView": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "backupId": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "mode": {
            "enum": [
              "new",
              "in_place"
            ],
            "type": "string"
          },
          "preBackupId": {
            "type": "string"
          },
          "sourceServiceId": {
            "type": "string"
          },
          "status": {
            "enum": [
              "provisioning",
              "pre_backup",
              "restoring",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "targetServiceId": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "backupId",
          "mode",
          "sourceServiceId",
          "status",
          "createdAt"
        ],
        "type": "object"
      },
      "RestoreVolumeBackupInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirmSlug": {
            "description": "In-place restores: the service's slug.",
            "type": "string"
          },
          "mode": {
            "default": "new_volume",
            "description": "new_volume restores into a new Docker volume and stages the swap (apply it with Deploy); the current volume is kept. in_place stops the service, overwrites the volume after a safety backup and starts it again.",
            "enum": [
              "new_volume",
              "in_place"
            ],
            "type": "string"
          },
          "volume": {
            "description": "The volume's name in the service.",
            "maxLength": 63,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "volume"
        ],
        "type": "object"
      },
      "Retention": {
        "additionalProperties": false,
        "properties": {
          "dailyDays": {
            "format": "int64",
            "type": "integer"
          },
          "hourlyDays": {
            "format": "int64",
            "type": "integer"
          },
          "minuteHours": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "minuteHours",
          "hourlyDays",
          "dailyDays"
        ],
        "type": "object"
      },
      "RetiredVolumeListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RetiredVolumeView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "RetiredVolumeView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "dockerName": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "volumeName": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "serviceId",
          "volumeName",
          "dockerName",
          "createdAt"
        ],
        "type": "object"
      },
      "RevealInputBody": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "description": "One of the database's exports, e.g. DATABASE_URL",
            "maxLength": 64,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "key"
        ],
        "type": "object"
      },
      "RevealOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PlatformCredential"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "Revealed": {
        "additionalProperties": false,
        "properties": {
          "expiresAt": {
            "description": "The value is meant to be shown for this long only; clients must not persist it",
            "format": "date-time",
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "revealedAt": {
            "format": "date-time",
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "value",
          "revealedAt",
          "expiresAt"
        ],
        "type": "object"
      },
      "RollbackView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "actorType": {
            "type": "string"
          },
          "build": {
            "$ref": "#/components/schemas/BuildInfo"
          },
          "buildServerId": {
            "type": "string"
          },
          "buildServerName": {
            "type": "string"
          },
          "cancelRequestedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "cancelRequestedBy": {
            "type": "string"
          },
          "canceledAtStep": {
            "type": "string"
          },
          "commit": {
            "$ref": "#/components/schemas/CommitView"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "disclaimer": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "message": {
            "type": [
              "string",
              "null"
            ]
          },
          "noCache": {
            "type": "boolean"
          },
          "release": {
            "$ref": "#/components/schemas/ReleaseView"
          },
          "releaseId": {
            "type": "string"
          },
          "rolledBackFrom": {
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          },
          "strategy": {
            "enum": [
              "rolling",
              "recreate",
              "route_only"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "manual",
              "redeploy",
              "rollback",
              "staged",
              "reconcile",
              "drain",
              "git_push",
              "preview",
              "cron",
              "deploy_hook"
            ],
            "type": "string"
          },
          "waitingFor": {
            "$ref": "#/components/schemas/WaitingFor"
          }
        },
        "required": [
          "disclaimer",
          "id",
          "serviceId",
          "releaseId",
          "serverId",
          "trigger",
          "actorType",
          "actorLabel",
          "status",
          "strategy",
          "statusMessage",
          "rolledBackFrom",
          "generation",
          "createdAt",
          "startedAt",
          "finishedAt",
          "release",
          "message",
          "waitingFor",
          "build",
          "commit",
          "cancelRequestedAt",
          "cancelRequestedBy",
          "canceledAtStep",
          "buildServerId"
        ],
        "type": "object"
      },
      "RolloutView": {
        "additionalProperties": false,
        "properties": {
          "serverIds": {
            "description": "The servers in upgrade order. They are upgraded one at a time; the rollout stops at the first failure.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serverIds"
        ],
        "type": "object"
      },
      "RotateInputBody": {
        "additionalProperties": false,
        "properties": {
          "dryRun": {
            "description": "Only return the plan",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "RotateOutputBody": {
        "additionalProperties": false,
        "properties": {
          "signingSecret": {
            "description": "The new signing secret. Shown only in this response.",
            "type": "string"
          }
        },
        "required": [
          "signingSecret"
        ],
        "type": "object"
      },
      "RotationAffected": {
        "additionalProperties": false,
        "properties": {
          "downtime": {
            "enum": [
              "none",
              "brief"
            ],
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "strategy": {
            "enum": [
              "rolling",
              "recreate"
            ],
            "type": "string"
          },
          "via": {
            "description": "Keys of this service whose resolved value changes",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceId",
          "slug",
          "via",
          "strategy",
          "downtime"
        ],
        "type": "object"
      },
      "RotationBlocker": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "RotationPlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "consumers": {
            "description": "Services that reference this database; they are staged and need a deploy",
            "items": {
              "$ref": "#/components/schemas/ConsumerRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "databaseRestart": {
            "type": "boolean"
          },
          "mode": {
            "enum": [
              "exec",
              "redeploy",
              "variable"
            ],
            "type": "string"
          },
          "passwordKey": {
            "description": "The variable that holds the rotated password",
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "mode",
          "passwordKey",
          "consumers",
          "databaseRestart",
          "warnings",
          "blockers"
        ],
        "type": "object"
      },
      "RotationResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          },
          "dryRun": {
            "type": "boolean"
          },
          "plan": {
            "$ref": "#/components/schemas/RotationPlan"
          },
          "rotationId": {
            "type": "string"
          },
          "status": {
            "enum": [
              "planned",
              "pending",
              "applied"
            ],
            "type": "string"
          }
        },
        "required": [
          "plan",
          "dryRun",
          "status"
        ],
        "type": "object"
      },
      "RotationView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "mode": {
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "applied",
              "failed"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "mode",
          "status",
          "createdAt"
        ],
        "type": "object"
      },
      "RouteConfig": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "denyCidrs": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "healthPath": {
            "type": "string"
          },
          "insecureSkipVerify": {
            "type": "boolean"
          },
          "listenPort": {
            "format": "int64",
            "type": "integer"
          },
          "openToInternet": {
            "type": "boolean"
          },
          "passHost": {
            "type": "boolean"
          },
          "protocol": {
            "type": "string"
          },
          "proxyProtocol": {
            "format": "int64",
            "type": "integer"
          },
          "publicDatabase": {
            "type": "boolean"
          },
          "scheme": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          },
          "upstreams": {
            "items": {
              "$ref": "#/components/schemas/RouteUpstream"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "verifySkip": {
            "type": "boolean"
          }
        },
        "required": [
          "protocol",
          "upstreams"
        ],
        "type": "object"
      },
      "RouteOptions": {
        "additionalProperties": false,
        "properties": {
          "access": {
            "$ref": "#/components/schemas/Access"
          },
          "basicAuth": {
            "type": "boolean"
          },
          "compress": {
            "type": "boolean"
          },
          "cors": {
            "$ref": "#/components/schemas/CORS"
          },
          "forceHttps": {
            "type": "boolean"
          },
          "largeUploads": {
            "type": "boolean"
          },
          "noindex": {
            "type": "boolean"
          },
          "rateLimit": {
            "$ref": "#/components/schemas/RateLimit"
          },
          "redirects": {
            "items": {
              "$ref": "#/components/schemas/Redirect"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requestHeaders": {
            "items": {
              "$ref": "#/components/schemas/Header"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "responseHeaders": {
            "items": {
              "$ref": "#/components/schemas/Header"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "securityHeaders": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "RouteUpstream": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "serviceId": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "RouteView": {
        "additionalProperties": false,
        "properties": {
          "alias": {
            "type": "string"
          },
          "consumerId": {
            "type": "string"
          },
          "consumerSlug": {
            "type": "string"
          },
          "devicesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "keys": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "notExposable": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "provider": {
            "type": "string"
          },
          "providerId": {
            "type": "string"
          },
          "server": {
            "$ref": "#/components/schemas/MeshServerRef",
            "description": "The provider's server"
          },
          "source": {
            "description": "The first source of the route (reference or edge)",
            "type": "string"
          },
          "sources": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "consumerId",
          "consumerSlug",
          "providerId",
          "provider",
          "server",
          "alias",
          "port",
          "state",
          "source",
          "sources",
          "keys",
          "devicesAdded"
        ],
        "type": "object"
      },
      "RoutesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ProxyRoute"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "Rule": {
        "additionalProperties": false,
        "properties": {
          "action": {
            "type": "string"
          },
          "dst": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "src": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "action",
          "src",
          "dst"
        ],
        "type": "object"
      },
      "RuleView": {
        "additionalProperties": false,
        "properties": {
          "because": {
            "type": "string"
          },
          "dst": {
            "description": "\u003cremote server node IPv4\u003e:\u003cmesh port\u003e",
            "type": "string"
          },
          "linkId": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "src": {
            "type": "string"
          }
        },
        "required": [
          "src",
          "dst",
          "port",
          "linkId",
          "because"
        ],
        "type": "object"
      },
      "RunCommandInputBody": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "description": "Argv, run without a shell. Wrap in [\"sh\",\"-c\",…] for shell syntax.",
            "items": {
              "type": "string"
            },
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "timeoutSeconds": {
            "description": "Default 1800 (30 minutes).",
            "format": "int64",
            "maximum": 86400,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "command"
        ],
        "type": "object"
      },
      "RunListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/RunView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "RunView": {
        "additionalProperties": false,
        "properties": {
          "actorLabel": {
            "type": "string"
          },
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "description": "Why the run failed, timed out or was skipped.",
            "type": "string"
          },
          "exitCode": {
            "format": "int64",
            "type": "integer"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "logLines": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "description": "The task's name, or \"one-off\" for a command.",
            "type": "string"
          },
          "scheduledFor": {
            "format": "date-time",
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "source": {
            "description": "cron, manual (Run now), one_off (run command) or a feature such as preview_seed.",
            "type": "string"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "queued",
              "running",
              "succeeded",
              "failed",
              "timed_out",
              "skipped"
            ],
            "type": "string"
          },
          "taskId": {
            "type": "string"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "serviceId",
          "name",
          "source",
          "command",
          "status",
          "timeoutSeconds",
          "logLines",
          "createdAt"
        ],
        "type": "object"
      },
      "ScaleEvent": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "from": {
            "format": "int64",
            "type": "integer"
          },
          "reason": {
            "type": "string"
          },
          "to": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "at",
          "from",
          "to",
          "reason",
          "actor"
        ],
        "type": "object"
      },
      "ScalingView": {
        "additionalProperties": false,
        "properties": {
          "autoscaling": {
            "$ref": "#/components/schemas/Autoscaling"
          },
          "blockedReason": {
            "type": [
              "string",
              "null"
            ]
          },
          "eligible": {
            "type": "boolean"
          },
          "ineligibleReason": {
            "type": [
              "string",
              "null"
            ]
          },
          "lastScaleEvent": {
            "$ref": "#/components/schemas/ScaleEvent"
          },
          "ready": {
            "format": "int64",
            "type": "integer"
          },
          "replicas": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "replicas",
          "ready",
          "autoscaling",
          "lastScaleEvent",
          "blockedReason",
          "eligible",
          "ineligibleReason"
        ],
        "type": "object"
      },
      "ScheduleListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/ScheduleView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "SchedulePreview": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "description": "Human-readable summary naming the time zone.",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "nextRuns": {
            "description": "The next runs as UTC instants.",
            "items": {
              "format": "date-time",
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "timezone": {
            "description": "The normalized zone the preview was computed in.",
            "type": "string"
          },
          "valid": {
            "type": "boolean"
          }
        },
        "required": [
          "valid",
          "nextRuns"
        ],
        "type": "object"
      },
      "ScheduleView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "cron": {
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "destinationName": {
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "lastRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "nextRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "retentionCount": {
            "format": "int64",
            "type": "integer"
          },
          "retentionDays": {
            "format": "int64",
            "type": "integer"
          },
          "serviceId": {
            "type": "string"
          },
          "timezone": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "serviceId",
          "destinationId",
          "cron",
          "timezone",
          "enabled",
          "retentionCount",
          "retentionDays",
          "createdAt"
        ],
        "type": "object"
      },
      "ScopeGrant": {
        "additionalProperties": false,
        "properties": {
          "environmentId": {
            "description": "Omit to allow every environment of the project, including ones created later",
            "type": "string"
          },
          "environmentName": {
            "readOnly": true,
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "projectName": {
            "readOnly": true,
            "type": "string"
          }
        },
        "required": [
          "projectId"
        ],
        "type": "object"
      },
      "SecondFactorInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "A 6-digit authenticator code or a recovery code",
            "maxLength": 40,
            "minLength": 6,
            "type": "string"
          }
        },
        "required": [
          "code"
        ],
        "type": "object"
      },
      "SecondFactorMethodsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "passkey": {
            "description": "A passkey can finish the sign-in",
            "type": "boolean"
          },
          "totp": {
            "description": "An authenticator-app or recovery code can finish the sign-in",
            "type": "boolean"
          }
        },
        "required": [
          "totp",
          "passkey"
        ],
        "type": "object"
      },
      "SecretManager": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/SecretManagerConfig"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "example": {
            "description": "A reference in this integration's syntax",
            "type": "string"
          },
          "grants": {
            "description": "With scope selected: the projects and environments that may reference the integration",
            "items": {
              "$ref": "#/components/schemas/ScopeGrant"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "vault",
              "infisical",
              "doppler"
            ],
            "type": "string"
          },
          "lastTest": {
            "$ref": "#/components/schemas/SecretManagerLastTest"
          },
          "name": {
            "description": "Used in references: ${{vault:\u003cname\u003e/\u003cpath\u003e#\u003ckey\u003e}} or ${{doppler:\u003cname\u003e/\u003cproject\u003e/\u003cconfig\u003e#\u003ckey\u003e}}",
            "type": "string"
          },
          "scope": {
            "enum": [
              "team",
              "selected"
            ],
            "type": "string"
          },
          "secretSet": {
            "type": "boolean"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "kind",
          "config",
          "secretSet",
          "scope",
          "grants",
          "lastTest",
          "example",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "SecretManagerBody": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "Vault or OpenBao address, e.g. https://vault.example.com:8200",
            "type": "string"
          },
          "approleMount": {
            "description": "AppRole auth mount (default approle)",
            "type": "string"
          },
          "authMethod": {
            "description": "token (default) or approle",
            "enum": [
              "token",
              "approle"
            ],
            "type": "string"
          },
          "caCert": {
            "description": "PEM certificate(s) to trust for a private CA (public material)",
            "type": "string"
          },
          "clientId": {
            "description": "Machine identity client id (universal auth)",
            "type": "string"
          },
          "defaultConfig": {
            "description": "Doppler config used by references that name none (with defaultProject)",
            "type": "string"
          },
          "defaultProject": {
            "description": "Doppler project used by references that name none, like doppler:\u003cname\u003e#KEY. Set with defaultConfig, or leave both empty (a service token is bound to one config)",
            "type": "string"
          },
          "grants": {
            "description": "With scope selected: the projects (or single environments) allowed to reference the integration. At least one.",
            "items": {
              "$ref": "#/components/schemas/ScopeGrant"
            },
            "maxItems": 200,
            "type": [
              "array",
              "null"
            ]
          },
          "mount": {
            "description": "KV v2 mount path (default secret)",
            "type": "string"
          },
          "namespace": {
            "description": "Vault Enterprise / OpenBao namespace (X-Vault-Namespace)",
            "type": "string"
          },
          "organizationSlug": {
            "description": "Optional organization slug to scope the login to",
            "type": "string"
          },
          "projectId": {
            "description": "Infisical project id",
            "type": "string"
          },
          "roleId": {
            "description": "AppRole role id",
            "type": "string"
          },
          "scope": {
            "description": "team (default on create): every project may reference the integration. selected: only the projects and environments in grants. Omit on update to keep the stored scope.",
            "enum": [
              "team",
              "selected"
            ],
            "type": "string"
          },
          "secret": {
            "description": "Write-only: the Vault token (token auth), the AppRole secret id, the Infisical client secret or the Doppler token. Omit on update to keep the stored one.",
            "maxLength": 4096,
            "type": "string"
          },
          "siteUrl": {
            "description": "Infisical URL (default https://us.infisical.com) or Doppler API URL (default https://api.doppler.com)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "SecretManagerConfig": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "Vault or OpenBao address, e.g. https://vault.example.com:8200",
            "type": "string"
          },
          "approleMount": {
            "description": "AppRole auth mount (default approle)",
            "type": "string"
          },
          "authMethod": {
            "description": "token (default) or approle",
            "enum": [
              "token",
              "approle"
            ],
            "type": "string"
          },
          "caCert": {
            "description": "PEM certificate(s) to trust for a private CA (public material)",
            "type": "string"
          },
          "clientId": {
            "description": "Machine identity client id (universal auth)",
            "type": "string"
          },
          "defaultConfig": {
            "description": "Doppler config used by references that name none (with defaultProject)",
            "type": "string"
          },
          "defaultProject": {
            "description": "Doppler project used by references that name none, like doppler:\u003cname\u003e#KEY. Set with defaultConfig, or leave both empty (a service token is bound to one config)",
            "type": "string"
          },
          "mount": {
            "description": "KV v2 mount path (default secret)",
            "type": "string"
          },
          "namespace": {
            "description": "Vault Enterprise / OpenBao namespace (X-Vault-Namespace)",
            "type": "string"
          },
          "organizationSlug": {
            "description": "Optional organization slug to scope the login to",
            "type": "string"
          },
          "projectId": {
            "description": "Infisical project id",
            "type": "string"
          },
          "roleId": {
            "description": "AppRole role id",
            "type": "string"
          },
          "siteUrl": {
            "description": "Infisical URL (default https://us.infisical.com) or Doppler API URL (default https://api.doppler.com)",
            "type": "string"
          }
        },
        "type": "object"
      },
      "SecretManagerLastTest": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "error": {
            "type": "string"
          },
          "ok": {
            "type": [
              "boolean",
              "null"
            ]
          }
        },
        "required": [
          "at",
          "ok"
        ],
        "type": "object"
      },
      "SecretManagerTestResult": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "read": {
            "type": "boolean"
          }
        },
        "required": [
          "ok",
          "message",
          "read"
        ],
        "type": "object"
      },
      "SecretOutputBody": {
        "additionalProperties": false,
        "properties": {
          "webhookSecret": {
            "description": "Shown once",
            "type": "string"
          }
        },
        "required": [
          "webhookSecret"
        ],
        "type": "object"
      },
      "SecurityBody": {
        "additionalProperties": false,
        "properties": {
          "enrollmentNeeded": {
            "description": "The current team requires 2FA and this account has not enrolled; everything else is blocked until it does",
            "type": "boolean"
          },
          "hasPassword": {
            "type": "boolean"
          },
          "identities": {
            "items": {
              "$ref": "#/components/schemas/IdentityBody"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "isInstanceAdmin": {
            "type": "boolean"
          },
          "passkeys": {
            "items": {
              "$ref": "#/components/schemas/PasskeyBody"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "passkeysUnavailable": {
            "description": "Why passkeys cannot be used at this address (it needs HTTPS and a domain name); absent when they can",
            "type": "string"
          },
          "recoveryCodesLeft": {
            "format": "int64",
            "type": "integer"
          },
          "requiredByTeams": {
            "items": {
              "$ref": "#/components/schemas/RequiredTeamBody"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "sessionMfa": {
            "description": "This session proved a second factor",
            "type": "boolean"
          },
          "totpEnabled": {
            "type": "boolean"
          },
          "totpPending": {
            "description": "A secret was generated but not confirmed yet",
            "type": "boolean"
          }
        },
        "required": [
          "totpEnabled",
          "totpPending",
          "recoveryCodesLeft",
          "passkeys",
          "hasPassword",
          "sessionMfa",
          "enrollmentNeeded",
          "requiredByTeams",
          "identities",
          "isInstanceAdmin"
        ],
        "type": "object"
      },
      "SeriesPoint": {
        "additionalProperties": false,
        "properties": {
          "bytesOut": {
            "format": "int64",
            "type": "integer"
          },
          "p50Ms": {
            "format": "double",
            "type": "number"
          },
          "p95Ms": {
            "format": "double",
            "type": "number"
          },
          "p99Ms": {
            "format": "double",
            "type": "number"
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          },
          "s2xx": {
            "format": "int64",
            "type": "integer"
          },
          "s3xx": {
            "format": "int64",
            "type": "integer"
          },
          "s4xx": {
            "format": "int64",
            "type": "integer"
          },
          "s5xx": {
            "format": "int64",
            "type": "integer"
          },
          "ts": {
            "format": "date-time",
            "type": "string"
          },
          "visitors": {
            "description": "Approximate distinct visitors inside this step; not additive",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "ts",
          "requests",
          "s2xx",
          "s3xx",
          "s4xx",
          "s5xx",
          "bytesOut",
          "visitors",
          "p50Ms",
          "p95Ms",
          "p99Ms"
        ],
        "type": "object"
      },
      "Server": {
        "additionalProperties": false,
        "properties": {
          "acceptWorkloads": {
            "description": "Whether services may be scheduled on this server. Turning it off keeps what already runs here and refuses new placements and moves.",
            "type": "boolean"
          },
          "acmeEmail": {
            "type": [
              "string",
              "null"
            ]
          },
          "agentVersion": {
            "type": [
              "string",
              "null"
            ]
          },
          "baseDomain": {
            "type": [
              "string",
              "null"
            ]
          },
          "buildAllowEmulation": {
            "description": "Allow building for another CPU architecture through emulation (slow); needs the agent to report emulation for the platform",
            "type": "boolean"
          },
          "buildAllowPreviews": {
            "description": "Allow pull request previews (untrusted code) to build here; off by default",
            "type": "boolean"
          },
          "buildEnabled": {
            "description": "The server builds images for other servers and pushes them to a registry (the Builds or Both role). Independent of acceptWorkloads.",
            "type": "boolean"
          },
          "buildMaxConcurrent": {
            "description": "Builds that run at the same time; more queue on the control plane",
            "format": "int64",
            "type": "integer"
          },
          "composeVersion": {
            "description": "Docker Compose plugin version the agent reported, empty when it has none",
            "type": "string"
          },
          "controlPlane": {
            "description": "The host the installer put the control plane on; its proxy serves the dashboard",
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "diskAlert": {
            "description": "True while the root filesystem is at or above the threshold",
            "type": "boolean"
          },
          "diskAlertThresholdPercent": {
            "description": "Root filesystem usage that raises the disk alert (50-99)",
            "format": "int64",
            "type": "integer"
          },
          "drainMessage": {
            "description": "Why the last drain failed or was canceled, empty otherwise",
            "type": "string"
          },
          "drainStartedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "drainState": {
            "description": "Evacuation state; draining and drained servers accept no new services",
            "enum": [
              "none",
              "draining",
              "drained",
              "failed"
            ],
            "type": "string"
          },
          "facts": {
            "$ref": "#/components/schemas/Facts"
          },
          "geoEnabled": {
            "description": "Count where requests come from (country, and city at the city level) from the client IP; IPs are never stored",
            "type": "boolean"
          },
          "geoLevel": {
            "description": "country needs a ~8 MB database on the server, city ~130 MB",
            "enum": [
              "country",
              "city"
            ],
            "type": "string"
          },
          "geoRefreshDays": {
            "description": "Check for a newer database every N days (1-90)",
            "format": "int64",
            "type": "integer"
          },
          "geoSource": {
            "description": "dbip = DB-IP Lite (CC BY 4.0, no key); maxmind = MaxMind GeoLite2 with the team's account",
            "enum": [
              "dbip",
              "maxmind"
            ],
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastSeenAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "latest": {
            "$ref": "#/components/schemas/Latest"
          },
          "metricsRetentionDays": {
            "description": "How long resource metric history is kept (1-90)",
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "patches": {
            "$ref": "#/components/schemas/ServerPatchSummary"
          },
          "protocolVersion": {
            "format": "int32",
            "type": [
              "integer",
              "null"
            ]
          },
          "proxy": {
            "$ref": "#/components/schemas/Proxy"
          },
          "publicIp": {
            "type": [
              "string",
              "null"
            ]
          },
          "serviceCount": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "enum": [
              "pending",
              "online",
              "offline",
              "revoked"
            ],
            "type": "string"
          },
          "trafficAnalyticsEnabled": {
            "description": "Aggregate Traefik access logs into traffic analytics",
            "type": "boolean"
          },
          "trafficDailyRetentionDays": {
            "description": "Daily traffic history (7-365 days)",
            "format": "int64",
            "type": "integer"
          },
          "trafficHourlyRetentionDays": {
            "description": "Hourly traffic history (2-90 days)",
            "format": "int64",
            "type": "integer"
          },
          "tunnel": {
            "$ref": "#/components/schemas/ServerTunnelSummary"
          },
          "unrestricted": {
            "description": "An instance admin made this server unrestricted: stacks and services on it may use privileged mode, host networking, devices, GPUs, a runtime, the host PID namespace, unconfined seccomp or AppArmor, NET_ADMIN, SYS_ADMIN, the Docker socket and host bind mounts",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "publicIp",
          "baseDomain",
          "acmeEmail",
          "agentVersion",
          "protocolVersion",
          "facts",
          "lastSeenAt",
          "createdAt",
          "proxy",
          "latest",
          "serviceCount",
          "metricsRetentionDays",
          "diskAlertThresholdPercent",
          "trafficAnalyticsEnabled",
          "trafficHourlyRetentionDays",
          "trafficDailyRetentionDays",
          "diskAlert",
          "geoEnabled",
          "geoSource",
          "geoLevel",
          "geoRefreshDays",
          "drainState",
          "drainMessage",
          "drainStartedAt",
          "acceptWorkloads",
          "buildEnabled",
          "buildMaxConcurrent",
          "buildAllowEmulation",
          "buildAllowPreviews",
          "controlPlane",
          "unrestricted",
          "composeVersion",
          "tunnel",
          "patches"
        ],
        "type": "object"
      },
      "ServerCertificate": {
        "additionalProperties": false,
        "properties": {
          "appliedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "change": {
            "description": "Staged change awaiting Deploy proxy",
            "enum": [
              "none",
              "add",
              "remove"
            ],
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "daysToExpiry": {
            "description": "Whole days until NotAfter (negative when expired)",
            "format": "int64",
            "type": "integer"
          },
          "domains": {
            "description": "Subject Alternative Names (DNS and IP)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "fingerprint": {
            "description": "SHA-256 of the leaf certificate, hex",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "notAfter": {
            "format": "date-time",
            "type": "string"
          },
          "notBefore": {
            "format": "date-time",
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "status": {
            "description": "pending: never applied; active: loaded by the proxy; error: expired or the proxy could not load it",
            "enum": [
              "pending",
              "active",
              "error"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "serverId",
          "name",
          "domains",
          "issuer",
          "fingerprint",
          "notBefore",
          "notAfter",
          "daysToExpiry",
          "status",
          "statusMessage",
          "change",
          "appliedAt",
          "createdAt"
        ],
        "type": "object"
      },
      "ServerCheckResult": {
        "additionalProperties": false,
        "properties": {
          "latencyMs": {
            "format": "int64",
            "type": "integer"
          },
          "message": {
            "type": "string"
          },
          "outcome": {
            "enum": [
              "connected",
              "refused",
              "timeout",
              "no_path"
            ],
            "type": "string"
          },
          "peerServerId": {
            "type": "string"
          }
        },
        "required": [
          "outcome"
        ],
        "type": "object"
      },
      "ServerDNS01": {
        "additionalProperties": false,
        "properties": {
          "acmeEmail": {
            "type": "string"
          },
          "baseDomain": {
            "description": "The domain generated hostnames live under (the server's base domain)",
            "type": "string"
          },
          "resolvers": {
            "items": {
              "$ref": "#/components/schemas/DNSResolverView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "staged": {
            "description": "Staged DNS-01 changes await Deploy proxy",
            "type": "boolean"
          },
          "wildcards": {
            "items": {
              "$ref": "#/components/schemas/WildcardCertView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "resolvers",
          "wildcards",
          "acmeEmail",
          "baseDomain",
          "staged"
        ],
        "type": "object"
      },
      "ServerInputBody": {
        "additionalProperties": false,
        "properties": {
          "force": {
            "description": "Install a version this agent rolled back before.",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "ServerMeshPlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "$ref": "#/components/schemas/Blocker"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "devicesAdded": {
            "description": "Tailnet devices the action adds (tagged devices may be billed by Tailscale)",
            "format": "int64",
            "type": "integer"
          },
          "tunDevice": {
            "description": "The host has /dev/net/tun. Server nodes do not need it; cross-server links (their consumer side) do",
            "type": "boolean"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "devicesAdded",
          "tunDevice",
          "warnings",
          "blockers"
        ],
        "type": "object"
      },
      "ServerMeshResult": {
        "additionalProperties": false,
        "properties": {
          "applied": {
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "plan": {
            "$ref": "#/components/schemas/ServerMeshPlan"
          }
        },
        "required": [
          "plan",
          "applied",
          "enabled"
        ],
        "type": "object"
      },
      "ServerMeshView": {
        "additionalProperties": false,
        "properties": {
          "agentCapable": {
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "links": {
            "description": "Link nodes that run on this server",
            "items": {
              "$ref": "#/components/schemas/MeshLinkView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "node": {
            "$ref": "#/components/schemas/NodeView"
          },
          "paused": {
            "type": "boolean"
          },
          "tunDevice": {
            "type": "boolean"
          }
        },
        "required": [
          "enabled",
          "agentCapable",
          "tunDevice",
          "paused",
          "node",
          "links"
        ],
        "type": "object"
      },
      "ServerMetricsOutputBody": {
        "additionalProperties": false,
        "properties": {
          "points": {
            "items": {
              "$ref": "#/components/schemas/MetricPoint"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "retentionDays": {
            "description": "How many days of history this server keeps; longer ranges only show what is retained",
            "format": "int64",
            "type": "integer"
          },
          "stepSeconds": {
            "description": "Bucket width of every point",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "points",
          "stepSeconds",
          "retentionDays"
        ],
        "type": "object"
      },
      "ServerPatchSummary": {
        "additionalProperties": false,
        "properties": {
          "busy": {
            "description": "The check, upgrade or reboot in flight, if any",
            "enum": [
              "check",
              "apply",
              "reboot",
              ""
            ],
            "type": "string"
          },
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "known": {
            "description": "A check for OS updates has completed at least once",
            "type": "boolean"
          },
          "rebootRequired": {
            "description": "The host asks for a reboot",
            "type": "boolean"
          },
          "security": {
            "description": "How many of them are security updates",
            "format": "int64",
            "type": "integer"
          },
          "supported": {
            "description": "The host has a supported package manager (apt or dnf)",
            "type": "boolean"
          },
          "updates": {
            "description": "Pending package upgrades",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "known",
          "supported",
          "updates",
          "security",
          "rebootRequired",
          "checkedAt",
          "busy"
        ],
        "type": "object"
      },
      "ServerProxy": {
        "additionalProperties": false,
        "properties": {
          "agentTooOld": {
            "description": "True when the agent lacks proxy.v2; staging proxy features returns 422 agent_too_old",
            "type": "boolean"
          },
          "appliedGeneration": {
            "format": "int64",
            "type": "integer"
          },
          "appliedUpstreamPolicy": {
            "$ref": "#/components/schemas/ProxyUpstreamPolicy"
          },
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "certificates": {
            "items": {
              "$ref": "#/components/schemas/ServerCertificate"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "error": {
            "type": "string"
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "l4Ports": {
            "items": {
              "$ref": "#/components/schemas/ProxyL4Port"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "lastDeploy": {
            "$ref": "#/components/schemas/ProxyDeployInfo"
          },
          "ports": {
            "$ref": "#/components/schemas/ProxyPorts"
          },
          "staged": {
            "description": "Staged server-level changes await Deploy proxy",
            "type": "boolean"
          },
          "status": {
            "description": "Traefik state reported by the agent: ok, starting, error, or empty",
            "type": "string"
          },
          "tailnet": {
            "$ref": "#/components/schemas/ProxyTailnet"
          },
          "upstreamPolicy": {
            "$ref": "#/components/schemas/ProxyUpstreamPolicy"
          }
        },
        "required": [
          "status",
          "error",
          "capabilities",
          "agentTooOld",
          "generation",
          "appliedGeneration",
          "staged",
          "upstreamPolicy",
          "appliedUpstreamPolicy",
          "l4Ports",
          "certificates",
          "tailnet",
          "ports"
        ],
        "type": "object"
      },
      "ServerRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "lastSeenAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "lastSeenAt"
        ],
        "type": "object"
      },
      "ServerTailnetSummary": {
        "additionalProperties": false,
        "properties": {
          "appliedMode": {
            "enum": [
              "off",
              "managed",
              "host"
            ],
            "type": "string"
          },
          "fqdn": {
            "type": "string"
          },
          "hostname": {
            "type": "string"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "mode": {
            "description": "Desired mode",
            "enum": [
              "off",
              "managed",
              "host"
            ],
            "type": "string"
          },
          "state": {
            "description": "Observed state: off, provisioning, online, offline, needs_attention, or empty when never reported",
            "type": "string"
          }
        },
        "required": [
          "mode",
          "appliedMode",
          "hostname",
          "state",
          "ips"
        ],
        "type": "object"
      },
      "ServerTunnelSummary": {
        "additionalProperties": false,
        "properties": {
          "active": {
            "description": "The connector connected: the server's domains in connected zones point at the tunnel",
            "type": "boolean"
          },
          "cname": {
            "description": "\u003ctunnelId\u003e.cfargotunnel.com",
            "type": "string"
          },
          "connections": {
            "description": "Ready connections to Cloudflare's edge",
            "format": "int64",
            "type": "integer"
          },
          "enabled": {
            "description": "The server has a Cloudflare Tunnel (or is removing one)",
            "type": "boolean"
          },
          "message": {
            "type": "string"
          },
          "observedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "description": "Observed connector state; off without a tunnel",
            "enum": [
              "off",
              "provisioning",
              "online",
              "offline",
              "needs_attention",
              "removing"
            ],
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "state",
          "active",
          "connections",
          "observedAt"
        ],
        "type": "object"
      },
      "ServerUpgradeView": {
        "additionalProperties": false,
        "properties": {
          "agentVersion": {
            "type": "string"
          },
          "canSelfUpgrade": {
            "type": "boolean"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "reason": {
            "description": "Why the agent cannot be upgraded now.",
            "type": "string"
          },
          "requestedAt": {
            "format": "date-time",
            "type": "string"
          },
          "serverId": {
            "type": "string"
          },
          "skew": {
            "description": "The agent against the control plane: behind (older), ahead (newer), current, or unknown when a version is not a release version.",
            "enum": [
              "current",
              "behind",
              "ahead",
              "unknown"
            ],
            "type": "string"
          },
          "state": {
            "enum": [
              "queued",
              "restarting",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "status": {
            "description": "pending, online, offline or revoked.",
            "type": "string"
          },
          "targetVersion": {
            "type": "string"
          },
          "trigger": {
            "enum": [
              "auto",
              "manual"
            ],
            "type": "string"
          },
          "upgradable": {
            "description": "The agent can be upgraded now.",
            "type": "boolean"
          }
        },
        "required": [
          "serverId",
          "name",
          "status",
          "skew",
          "canSelfUpgrade",
          "upgradable"
        ],
        "type": "object"
      },
      "ServiceMeshView": {
        "additionalProperties": false,
        "properties": {
          "consumers": {
            "description": "Services on other servers that reach this one",
            "items": {
              "$ref": "#/components/schemas/ConsumerView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "exposures": {
            "items": {
              "$ref": "#/components/schemas/ExposureView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "routes": {
            "description": "The providers on other servers this service reaches",
            "items": {
              "$ref": "#/components/schemas/RouteView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "exposures",
          "routes",
          "consumers"
        ],
        "type": "object"
      },
      "ServiceMetricPoint": {
        "additionalProperties": false,
        "properties": {
          "cpuMax": {
            "format": "double",
            "type": "number"
          },
          "cpuPerReplica": {
            "description": "Average per replica, in percent of one core",
            "format": "double",
            "type": "number"
          },
          "cpuPercent": {
            "description": "Sum over the replicas, in percent of one core",
            "format": "double",
            "type": "number"
          },
          "memBytes": {
            "description": "Sum over the replicas",
            "format": "int64",
            "type": "integer"
          },
          "memLimitBytes": {
            "format": "int64",
            "type": "integer"
          },
          "memMax": {
            "format": "int64",
            "type": "integer"
          },
          "replicaCount": {
            "description": "Replica containers sampled in this bucket",
            "format": "int64",
            "type": "integer"
          },
          "replicas": {
            "items": {
              "$ref": "#/components/schemas/ReplicaMetric"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ts": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "ts",
          "cpuPercent",
          "cpuPerReplica",
          "cpuMax",
          "memBytes",
          "memMax",
          "memLimitBytes",
          "replicaCount"
        ],
        "type": "object"
      },
      "ServiceRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "slug"
        ],
        "type": "object"
      },
      "ServiceView": {
        "additionalProperties": false,
        "properties": {
          "appliedGeneration": {
            "format": "int64",
            "type": "integer"
          },
          "config": {
            "$ref": "#/components/schemas/Config"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "currentDeploymentId": {
            "type": "string"
          },
          "currentRelease": {
            "$ref": "#/components/schemas/ReleaseRef"
          },
          "desiredState": {
            "enum": [
              "running",
              "stopped"
            ],
            "type": "string"
          },
          "domains": {
            "items": {
              "$ref": "#/components/schemas/DomainView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "environmentId": {
            "type": "string"
          },
          "generation": {
            "format": "int64",
            "type": "integer"
          },
          "git": {
            "$ref": "#/components/schemas/GitRef"
          },
          "gitTokenSet": {
            "type": "boolean"
          },
          "hasStagedChanges": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "app",
              "worker",
              "database",
              "route",
              "stack"
            ],
            "type": "string"
          },
          "latestDeployment": {
            "$ref": "#/components/schemas/DeploymentRef"
          },
          "maintenance": {
            "$ref": "#/components/schemas/MaintenanceView"
          },
          "name": {
            "type": "string"
          },
          "networks": {
            "items": {
              "$ref": "#/components/schemas/NetworkRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "observed": {
            "$ref": "#/components/schemas/ObservedView"
          },
          "observedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "pendingChangeCounts": {
            "$ref": "#/components/schemas/PendingChangeCounts"
          },
          "privateHost": {
            "type": "string"
          },
          "projectId": {
            "type": "string"
          },
          "registryAuthSet": {
            "type": "boolean"
          },
          "scaling": {
            "$ref": "#/components/schemas/ScalingView"
          },
          "server": {
            "$ref": "#/components/schemas/ServerRef"
          },
          "serverId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "sourceType": {
            "enum": [
              "image",
              "git",
              "external",
              "compose"
            ],
            "type": "string"
          },
          "stagedKind": {
            "description": "new | edited | null",
            "type": [
              "string",
              "null"
            ]
          },
          "stale": {
            "type": "boolean"
          },
          "tailnet": {
            "$ref": "#/components/schemas/TailnetView"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "volumes": {
            "items": {
              "$ref": "#/components/schemas/VolumeRef"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "environmentId",
          "projectId",
          "name",
          "slug",
          "kind",
          "sourceType",
          "config",
          "serverId",
          "server",
          "generation",
          "appliedGeneration",
          "hasStagedChanges",
          "currentDeploymentId",
          "latestDeployment",
          "currentRelease",
          "observed",
          "observedAt",
          "stale",
          "domains",
          "privateHost",
          "gitTokenSet",
          "registryAuthSet",
          "createdAt",
          "updatedAt",
          "volumes",
          "desiredState",
          "pendingChangeCounts",
          "stagedKind",
          "scaling",
          "maintenance",
          "git",
          "tailnet",
          "networks"
        ],
        "type": "object"
      },
      "SetGeoCredentialsInputBody": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "description": "Numeric MaxMind account ID",
            "maxLength": 20,
            "minLength": 1,
            "type": "string"
          },
          "licenseKey": {
            "description": "MaxMind licence key; stored encrypted, never returned",
            "maxLength": 100,
            "minLength": 6,
            "type": "string"
          }
        },
        "required": [
          "accountId",
          "licenseKey"
        ],
        "type": "object"
      },
      "SetKeyInputBody": {
        "additionalProperties": false,
        "properties": {
          "privateKey": {
            "description": "Write-only. An unencrypted OpenSSH or PEM private key to use instead of a generated one; omit to generate an Ed25519 key",
            "maxLength": 16384,
            "type": "string"
          },
          "rotate": {
            "description": "Replace the existing key. Without it an existing key is a 409 ssh_key_exists",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "SetMaintenanceInputBody": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "description": "true puts the service into maintenance, false takes it out",
            "type": "boolean"
          },
          "eta": {
            "description": "When the service is expected back (future). Shown on the page and sent as Retry-After. Only used when enabling.",
            "format": "date-time",
            "type": "string"
          },
          "message": {
            "description": "Page message (plain text); empty shows the default copy. Only used when enabling.",
            "maxLength": 600,
            "type": "string"
          },
          "title": {
            "description": "Page title; empty shows 'Down for maintenance'. Only used when enabling.",
            "maxLength": 80,
            "type": "string"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "SetPublicPortInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "description": "Client networks (CIDRs or addresses) allowed to connect. Mandatory.",
            "items": {
              "type": "string"
            },
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "confirmOpen": {
            "description": "Required when allowCidrs admits every address (0.0.0.0/0 or ::/0): the database slug",
            "type": "string"
          },
          "denyCidrs": {
            "description": "Client networks refused first, even when allowCidrs admits them",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "listenPort": {
            "description": "Port on the server (not 80, 443 or a proxy port)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 1024,
            "type": "integer"
          }
        },
        "required": [
          "listenPort",
          "allowCidrs"
        ],
        "type": "object"
      },
      "SetResolverInputBody": {
        "additionalProperties": false,
        "properties": {
          "credentialId": {
            "type": "string"
          },
          "delaySeconds": {
            "description": "Wait before checking that the TXT record propagated (slow DNS providers)",
            "format": "int64",
            "maximum": 600,
            "minimum": 0,
            "type": "integer"
          },
          "staging": {
            "description": "Use the Let's Encrypt staging CA (untrusted certificates, generous rate limits)",
            "type": "boolean"
          }
        },
        "required": [
          "credentialId"
        ],
        "type": "object"
      },
      "SetScalingInputBody": {
        "additionalProperties": false,
        "properties": {
          "autoscaling": {
            "$ref": "#/components/schemas/AutoscalingPatch",
            "description": "Omitted fields keep their current value"
          },
          "replicas": {
            "description": "Desired replica count, 1-10. Not allowed while autoscaling is enabled.",
            "format": "int64",
            "type": "integer"
          }
        },
        "type": "object"
      },
      "SetServerMeshInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptMeshChanges": {
            "description": "Confirms that enabling adds tailnet devices (tagged devices may be billed by Tailscale)",
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "SetTeamSecurityInputBody": {
        "additionalProperties": false,
        "properties": {
          "require2fa": {
            "type": "boolean"
          }
        },
        "required": [
          "require2fa"
        ],
        "type": "object"
      },
      "SetUnrestrictedInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirm": {
            "description": "The server's name; required when enabling",
            "maxLength": 200,
            "type": "string"
          },
          "unrestricted": {
            "type": "boolean"
          }
        },
        "required": [
          "unrestricted"
        ],
        "type": "object"
      },
      "SettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "weekly": {
            "description": "Audit the host every week (default true)",
            "type": "boolean"
          }
        },
        "required": [
          "weekly"
        ],
        "type": "object"
      },
      "SettingsInputBody1": {
        "additionalProperties": false,
        "properties": {
          "aclMode": {
            "description": "managed: NebulaCtrl writes the policy (Headscale with an API key; Tailscale only as an opt-in that needs the OAuth scope policy_file and replaces only NebulaCtrl's own rules). advisory: the rules are shown, never written. off: no rules. Needs the admin scope.",
            "enum": [
              "managed",
              "advisory",
              "off"
            ],
            "type": "string"
          },
          "autoJoin": {
            "description": "Online servers with a current agent join the mesh automatically (each adds one device)",
            "type": "boolean"
          },
          "enabled": {
            "description": "Turning the mesh off is refused (409 mesh_in_use) while servers still have nodes",
            "type": "boolean"
          },
          "meshTag": {
            "description": "The tag every mesh node carries (default tag:nebula-mesh); it must be in the integration's allowed tags. Needs the admin scope; fixed while nodes exist.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "SettingsView": {
        "additionalProperties": false,
        "properties": {
          "backupGraceMinutes": {
            "description": "Extra time a scheduled backup gets after its due time before backup.missed is sent. 0 = automatic: a quarter of the schedule's interval, between 15 minutes and 6 hours.",
            "format": "int64",
            "maximum": 10080,
            "minimum": 0,
            "type": "integer"
          },
          "crashGraceSeconds": {
            "description": "A container that stays down (or restarting) this long is announced as crashed. A restart Docker performed after a crash is announced at once.",
            "format": "int64",
            "maximum": 3600,
            "minimum": 0,
            "type": "integer"
          },
          "flapIncidents": {
            "description": "Incidents within the flap window that make a flapping service: announced once, then silent until it has been stable for a whole window.",
            "format": "int64",
            "maximum": 20,
            "minimum": 2,
            "type": "integer"
          },
          "flapWindowMinutes": {
            "description": "The window incidents are counted in, and how long a flapping service must be stable before its recovery is sent.",
            "format": "int64",
            "maximum": 1440,
            "minimum": 5,
            "type": "integer"
          },
          "logLines": {
            "description": "Runtime log lines attached to a crash or restart-loop message (redacted for the service's secrets). 0 attaches none.",
            "format": "int64",
            "maximum": 20,
            "minimum": 0,
            "type": "integer"
          },
          "loopRestarts": {
            "description": "Docker restarts within the loop window that make a restart loop.",
            "format": "int64",
            "maximum": 50,
            "minimum": 2,
            "type": "integer"
          },
          "loopWindowMinutes": {
            "description": "The window the restarts are counted in.",
            "format": "int64",
            "maximum": 1440,
            "minimum": 1,
            "type": "integer"
          },
          "recoverAfterSeconds": {
            "description": "How long a service must look healthy before the incident is closed and service.recovered is sent.",
            "format": "int64",
            "maximum": 3600,
            "minimum": 10,
            "type": "integer"
          },
          "unhealthyGraceSeconds": {
            "description": "The health check must keep failing this long before service.unhealthy is sent.",
            "format": "int64",
            "maximum": 3600,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "crashGraceSeconds",
          "unhealthyGraceSeconds",
          "loopRestarts",
          "loopWindowMinutes",
          "recoverAfterSeconds",
          "flapIncidents",
          "flapWindowMinutes",
          "backupGraceMinutes",
          "logLines"
        ],
        "type": "object"
      },
      "SetupInputBody": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "format": "email",
            "maxLength": 254,
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "password": {
            "maxLength": 256,
            "minLength": 10,
            "type": "string"
          },
          "setupToken": {
            "description": "The one-time setup token printed by the installer; required only when the server was started with NEBULACTRL_SETUP_TOKEN",
            "maxLength": 128,
            "type": "string"
          },
          "teamName": {
            "description": "Name of the first team; default NebulaCtrl",
            "maxLength": 80,
            "type": "string"
          }
        },
        "required": [
          "email",
          "password",
          "name"
        ],
        "type": "object"
      },
      "SetupStatusOutputBody": {
        "additionalProperties": false,
        "properties": {
          "needsSetup": {
            "type": "boolean"
          },
          "tokenRequired": {
            "type": "boolean"
          }
        },
        "required": [
          "needsSetup",
          "tokenRequired"
        ],
        "type": "object"
      },
      "ShareSharedInput": {
        "additionalProperties": false,
        "properties": {
          "serviceIds": {
            "items": {
              "type": "string"
            },
            "maxItems": 200,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceIds"
        ],
        "type": "object"
      },
      "SharedVariableInput": {
        "additionalProperties": false,
        "properties": {
          "comment": {
            "maxLength": 1000,
            "type": "string"
          },
          "isSecret": {
            "type": "boolean"
          },
          "key": {
            "maxLength": 255,
            "minLength": 1,
            "type": "string"
          },
          "value": {
            "description": "Omit to keep the stored value. Generators run once; the same text again keeps the value.",
            "type": "string"
          }
        },
        "required": [
          "key"
        ],
        "type": "object"
      },
      "SharedVariableList": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/SharedVariableView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restaged": {
            "items": {
              "$ref": "#/components/schemas/RestagedServiceRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/VariableWarning"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "warnings",
          "restaged"
        ],
        "type": "object"
      },
      "SharedVariableView": {
        "additionalProperties": false,
        "properties": {
          "comment": {
            "type": "string"
          },
          "computedSecret": {
            "type": "boolean"
          },
          "generated": {
            "items": {
              "$ref": "#/components/schemas/GeneratorCall"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "inherited": {
            "description": "A project value shown in an environment listing; edit it on the project",
            "type": "boolean"
          },
          "isSecret": {
            "type": "boolean"
          },
          "key": {
            "type": "string"
          },
          "layer": {
            "enum": [
              "project",
              "environment",
              "team"
            ],
            "type": "string"
          },
          "overrides": {
            "description": "An environment value that overrides a project value",
            "type": "boolean"
          },
          "set": {
            "type": "boolean"
          },
          "source": {
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "usedBy": {
            "description": "Number of service variables that reference it",
            "format": "int64",
            "type": "integer"
          },
          "value": {
            "description": "Omitted for secrets",
            "type": "string"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "key",
          "isSecret",
          "computedSecret",
          "set",
          "layer",
          "overrides",
          "inherited",
          "source",
          "version",
          "comment",
          "generated",
          "usedBy",
          "updatedAt"
        ],
        "type": "object"
      },
      "SharedVariablesPutBody": {
        "additionalProperties": false,
        "properties": {
          "variables": {
            "items": {
              "$ref": "#/components/schemas/SharedVariableInput"
            },
            "maxItems": 500,
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "variables"
        ],
        "type": "object"
      },
      "SkippedVariable": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "reason"
        ],
        "type": "object"
      },
      "Sparklines": {
        "additionalProperties": false,
        "properties": {
          "bytesOut": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "p95Ms": {
            "items": {
              "format": "double",
              "type": "number"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requests": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "visitors": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "requests",
          "visitors",
          "bytesOut",
          "p95Ms"
        ],
        "type": "object"
      },
      "Spec": {
        "additionalProperties": false,
        "properties": {
          "databaseName": {
            "type": "string"
          },
          "engine": {
            "type": "string"
          },
          "flavor": {
            "type": "string"
          },
          "replica": {
            "$ref": "#/components/schemas/ReplicaSpec"
          },
          "username": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "engine",
          "version"
        ],
        "type": "object"
      },
      "StackCheck": {
        "additionalProperties": false,
        "properties": {
          "components": {
            "items": {
              "$ref": "#/components/schemas/StackComponent"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "composeAvailable": {
            "type": [
              "boolean",
              "null"
            ]
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "unrestricted": {
            "type": "boolean"
          },
          "violations": {
            "items": {
              "$ref": "#/components/schemas/Violation"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "components",
          "violations",
          "notes",
          "unrestricted",
          "composeAvailable"
        ],
        "type": "object"
      },
      "StackComponent": {
        "additionalProperties": false,
        "properties": {
          "image": {
            "type": "string"
          },
          "index": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "ports": {
            "items": {
              "format": "int64",
              "type": "integer"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "profiles": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "index"
        ],
        "type": "object"
      },
      "StackConfig": {
        "additionalProperties": false,
        "properties": {
          "components": {
            "description": "Derived by the server from the compose file; never set by clients",
            "items": {
              "$ref": "#/components/schemas/StackComponent"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "compose": {
            "description": "The compose file (YAML) as written; ${VAR} placeholders read the service's variables",
            "maxLength": 262144,
            "type": "string"
          },
          "resources": {
            "additionalProperties": {
              "$ref": "#/components/schemas/StackResources"
            },
            "description": "Per-component memory/CPU limits, keyed by component name; the compose file's own limits win",
            "type": "object"
          },
          "waitSeconds": {
            "description": "How long a deploy waits for every component to become healthy (default 300, max 3600)",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "compose",
          "components"
        ],
        "type": "object"
      },
      "StackConfigInput": {
        "additionalProperties": false,
        "properties": {
          "compose": {
            "description": "The compose file (YAML) as written; ${VAR} placeholders read the service's variables",
            "maxLength": 262144,
            "minLength": 1,
            "type": "string"
          },
          "resources": {
            "additionalProperties": {
              "$ref": "#/components/schemas/StackResources"
            },
            "description": "Per-component memory/CPU limits, keyed by component name; the compose file's own limits win",
            "type": "object"
          },
          "waitSeconds": {
            "description": "How long a deploy waits for every component to become healthy (default 300, max 3600)",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "compose"
        ],
        "type": "object"
      },
      "StackResources": {
        "additionalProperties": false,
        "properties": {
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          }
        },
        "type": "object"
      },
      "StagedResult": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DeploymentView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "order": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "order"
        ],
        "type": "object"
      },
      "StartInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirmStateful": {
            "description": "Required when a moved service has volumes or is a database: their data is not copied",
            "type": "boolean"
          },
          "moves": {
            "description": "Where every service on the server goes; each service must appear exactly once",
            "items": {
              "$ref": "#/components/schemas/MoveBody"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "moves"
        ],
        "type": "object"
      },
      "StatusCount": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "format": "int64",
            "type": "integer"
          },
          "n": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "code",
          "n"
        ],
        "type": "object"
      },
      "StatusView": {
        "additionalProperties": false,
        "properties": {
          "deployKeyLink": {
            "$ref": "#/components/schemas/DeployKeyLink"
          },
          "host": {
            "type": "string"
          },
          "hostKeys": {
            "items": {
              "$ref": "#/components/schemas/HostView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "key": {
            "$ref": "#/components/schemas/KeyView"
          },
          "usesSshUrl": {
            "type": "boolean"
          }
        },
        "required": [
          "usesSshUrl",
          "hostKeys"
        ],
        "type": "object"
      },
      "SuggestedVariable": {
        "additionalProperties": false,
        "properties": {
          "comment": {
            "description": "The comment above the key in the example file, as a hint",
            "type": "string"
          },
          "file": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "needsInput": {
            "type": "boolean"
          },
          "proposedSecret": {
            "type": "boolean"
          },
          "reason": {
            "type": "string"
          },
          "source": {
            "enum": [
              "database",
              "env-example"
            ],
            "type": "string"
          },
          "value": {
            "description": "Proposed value; may be a reference or a generator expression. Empty when the user must provide one.",
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "value",
          "source",
          "reason",
          "proposedSecret",
          "needsInput",
          "warnings"
        ],
        "type": "object"
      },
      "SuggestedVariableList": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "description": "Branch the .env.example files were read from",
            "type": "string"
          },
          "commit": {
            "description": "Commit the .env.example files were read from (empty when they were read through the git provider)",
            "type": "string"
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/SuggestedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "skipped": {
            "description": "Keys of the example files left out on purpose (platform variables such as PORT)",
            "items": {
              "$ref": "#/components/schemas/SkippedVariable"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "skipped"
        ],
        "type": "object"
      },
      "Summary": {
        "additionalProperties": false,
        "properties": {
          "botRequests": {
            "format": "int64",
            "type": "integer"
          },
          "bytesIn": {
            "format": "int64",
            "type": "integer"
          },
          "bytesOut": {
            "format": "int64",
            "type": "integer"
          },
          "clientErrorRate": {
            "description": "4xx responses / requests",
            "format": "double",
            "type": "number"
          },
          "documents": {
            "description": "GET/HEAD text/html responses (page views)",
            "format": "int64",
            "type": "integer"
          },
          "errorRate": {
            "description": "5xx responses / requests",
            "format": "double",
            "type": "number"
          },
          "p50Ms": {
            "format": "double",
            "type": "number"
          },
          "p95Ms": {
            "format": "double",
            "type": "number"
          },
          "p99Ms": {
            "format": "double",
            "type": "number"
          },
          "peakRps": {
            "description": "Highest per-bucket request rate at the stored resolution",
            "format": "double",
            "type": "number"
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          },
          "visitors": {
            "description": "Unique non-bot visitors, counted per UTC day (a person on two days counts twice)",
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "requests",
          "documents",
          "bytesOut",
          "bytesIn",
          "visitors",
          "botRequests",
          "p50Ms",
          "p95Ms",
          "p99Ms",
          "errorRate",
          "clientErrorRate",
          "peakRps"
        ],
        "type": "object"
      },
      "SyntaxProblem": {
        "additionalProperties": false,
        "properties": {
          "message": {
            "type": "string"
          },
          "offset": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "offset",
          "message"
        ],
        "type": "object"
      },
      "SyslogDrainConfig": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "type": "string"
          },
          "appName": {
            "type": "string"
          },
          "facility": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "type": "string"
          },
          "tlsInsecureSkipVerify": {
            "type": "boolean"
          },
          "tlsServerName": {
            "type": "string"
          }
        },
        "required": [
          "address",
          "protocol"
        ],
        "type": "object"
      },
      "SystemInfo": {
        "additionalProperties": false,
        "properties": {
          "mcpEnabled": {
            "description": "Whether the MCP endpoint is mounted (NEBULACTRL_MCP_ENABLED)",
            "type": "boolean"
          },
          "mcpUrl": {
            "description": "MCP endpoint URL: publicUrl + /mcp; empty when publicUrl is not configured",
            "type": "string"
          },
          "publicUrl": {
            "description": "NEBULACTRL_PUBLIC_URL; empty when not configured (clients fall back to the URL they reached the API on)",
            "type": "string"
          },
          "version": {
            "description": "Control-plane version",
            "type": "string"
          }
        },
        "required": [
          "version",
          "publicUrl",
          "mcpEnabled",
          "mcpUrl"
        ],
        "type": "object"
      },
      "TCPForward": {
        "additionalProperties": false,
        "properties": {
          "listen": {
            "format": "int64",
            "type": "integer"
          },
          "target": {
            "format": "int64",
            "type": "integer"
          },
          "tls": {
            "type": "boolean"
          }
        },
        "required": [
          "listen"
        ],
        "type": "object"
      },
      "TailnetConfig": {
        "additionalProperties": false,
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "extraTags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "funnel": {
            "type": "boolean"
          },
          "hidePublic": {
            "type": "boolean"
          },
          "hostname": {
            "type": "string"
          },
          "tcp": {
            "items": {
              "$ref": "#/components/schemas/TCPForward"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "web": {
            "type": "boolean"
          }
        },
        "required": [
          "enabled"
        ],
        "type": "object"
      },
      "TailnetStatus": {
        "additionalProperties": false,
        "properties": {
          "deviceId": {
            "type": "string"
          },
          "fqdn": {
            "type": "string"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "mode": {
            "type": "string"
          },
          "state": {
            "type": "string"
          }
        },
        "required": [
          "mode",
          "state"
        ],
        "type": "object"
      },
      "TailnetStruct": {
        "additionalProperties": false,
        "properties": {
          "hostname": {
            "description": "Machine name of the managed node (default nebula-\u003cserver name\u003e)",
            "maxLength": 63,
            "type": "string"
          },
          "magicDns": {
            "type": "boolean"
          },
          "mode": {
            "enum": [
              "off",
              "managed",
              "host"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "TailnetView": {
        "additionalProperties": false,
        "properties": {
          "fqdn": {
            "description": "MagicDNS name read back from the node (never assumed)",
            "type": "string"
          },
          "funnel": {
            "type": "boolean"
          },
          "hidePublic": {
            "type": "boolean"
          },
          "hostname": {
            "type": "string"
          },
          "ips": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "needsReprovision": {
            "type": "boolean"
          },
          "observedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "provider": {
            "enum": [
              "tailscale",
              "headscale"
            ],
            "type": "string"
          },
          "state": {
            "enum": [
              "provisioning",
              "online",
              "offline",
              "needs_attention",
              "removing"
            ],
            "type": "string"
          },
          "tcp": {
            "items": {
              "$ref": "#/components/schemas/TCPForward"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "url": {
            "description": "Web URL of the node (https on Tailscale, http on Headscale); empty without a web exposure or name",
            "type": "string"
          },
          "web": {
            "type": "boolean"
          }
        },
        "required": [
          "state",
          "message",
          "provider",
          "hostname",
          "fqdn",
          "url",
          "ips",
          "web",
          "tcp",
          "funnel",
          "hidePublic",
          "needsReprovision",
          "observedAt"
        ],
        "type": "object"
      },
      "TailscaleCheck": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "skipped": {
            "description": "The check could not run (optional scope missing)",
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "ok",
          "message"
        ],
        "type": "object"
      },
      "TailscaleDevice": {
        "additionalProperties": false,
        "properties": {
          "addresses": {
            "description": "Tailnet IP addresses (100.x and fd7a:...)",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "hostname": {
            "type": "string"
          },
          "id": {
            "description": "Stable node id (use it to delete the device)",
            "type": "string"
          },
          "lastSeen": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "name": {
            "description": "Fully qualified MagicDNS name",
            "type": "string"
          },
          "online": {
            "type": "boolean"
          },
          "os": {
            "type": "string"
          },
          "tags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "name",
          "hostname",
          "addresses",
          "tags",
          "os",
          "online",
          "lastSeen"
        ],
        "type": "object"
      },
      "TailscaleIntegration": {
        "additionalProperties": false,
        "properties": {
          "allowedTags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "clientId": {
            "type": "string"
          },
          "configured": {
            "type": "boolean"
          },
          "defaultTags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "headscaleCredential": {
            "description": "apikey: NebulaCtrl mints single-use pre-auth keys and deletes nodes; preauth: one reusable tagged pre-auth key for every sidecar",
            "enum": [
              "apikey",
              "preauth"
            ],
            "type": "string"
          },
          "headscaleUser": {
            "description": "Headscale user that owns minted pre-auth keys (empty = tags-only keys)",
            "type": "string"
          },
          "httpsEnabled": {
            "description": "Whether the tailnet has HTTPS certificates enabled (known after a successful test)",
            "type": [
              "boolean",
              "null"
            ]
          },
          "lastTest": {
            "$ref": "#/components/schemas/TailscaleLastTest"
          },
          "loginServer": {
            "description": "Headscale control URL (headscale provider)",
            "type": "string"
          },
          "provider": {
            "enum": [
              "tailscale_oauth",
              "headscale"
            ],
            "type": "string"
          },
          "secretSet": {
            "type": "boolean"
          },
          "tailnet": {
            "description": "Tailnet name, or - for the tailnet of the OAuth client",
            "type": "string"
          }
        },
        "required": [
          "configured",
          "provider",
          "tailnet",
          "clientId",
          "secretSet",
          "defaultTags",
          "allowedTags",
          "httpsEnabled",
          "lastTest",
          "loginServer",
          "headscaleUser",
          "headscaleCredential"
        ],
        "type": "object"
      },
      "TailscaleLastTest": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "error": {
            "type": "string"
          },
          "ok": {
            "type": [
              "boolean",
              "null"
            ]
          }
        },
        "required": [
          "at",
          "ok"
        ],
        "type": "object"
      },
      "TailscaleTestResult": {
        "additionalProperties": false,
        "properties": {
          "checks": {
            "items": {
              "$ref": "#/components/schemas/TailscaleCheck"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "ok": {
            "type": "boolean"
          }
        },
        "required": [
          "ok",
          "checks"
        ],
        "type": "object"
      },
      "TaskListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/TaskView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "TaskView": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "description": "Argv, run without a shell.",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "concurrency": {
            "enum": [
              "forbid",
              "allow"
            ],
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "enabled": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "lastRun": {
            "$ref": "#/components/schemas/RunView"
          },
          "lastRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "nextRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "schedule": {
            "description": "5-field cron expression or @macro, evaluated in timezone.",
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "timezone": {
            "description": "IANA time zone the schedule is evaluated in (default UTC). A daylight-saving gap skips that day's run; a repeated hour runs once.",
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "serviceId",
          "name",
          "schedule",
          "timezone",
          "command",
          "enabled",
          "timeoutSeconds",
          "concurrency",
          "createdAt",
          "updatedAt"
        ],
        "type": "object"
      },
      "Team": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "current": {
            "description": "The team the caller is acting in",
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "memberCount": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "projectIds": {
            "description": "The caller's project restriction; absent = all projects",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "description": "The caller's role in this team",
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "slug",
          "role",
          "memberCount",
          "current",
          "createdAt"
        ],
        "type": "object"
      },
      "TeamInvite": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "createdBy": {
            "type": "string"
          },
          "email": {
            "description": "Absent for link invites",
            "type": "string"
          },
          "emailSent": {
            "type": "boolean"
          },
          "exhausted": {
            "type": "boolean"
          },
          "expired": {
            "type": "boolean"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "maxUses": {
            "description": "1 = single use",
            "format": "int64",
            "type": "integer"
          },
          "prefix": {
            "description": "First characters of the token, to recognise the invite",
            "type": "string"
          },
          "projectIds": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          },
          "useCount": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "id",
          "role",
          "maxUses",
          "useCount",
          "prefix",
          "expiresAt",
          "emailSent",
          "createdAt",
          "expired",
          "exhausted"
        ],
        "type": "object"
      },
      "TeamMember": {
        "additionalProperties": false,
        "properties": {
          "email": {
            "type": "string"
          },
          "joinedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "projectIds": {
            "description": "Absent = every project of the team",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "role": {
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          },
          "userId": {
            "type": "string"
          },
          "you": {
            "type": "boolean"
          }
        },
        "required": [
          "userId",
          "name",
          "email",
          "role",
          "joinedAt",
          "you"
        ],
        "type": "object"
      },
      "TeamSecurityBody": {
        "additionalProperties": false,
        "properties": {
          "enrolled": {
            "description": "Members that have 2FA enabled",
            "format": "int64",
            "type": "integer"
          },
          "members": {
            "format": "int64",
            "type": "integer"
          },
          "require2fa": {
            "description": "Members must enrol 2FA before acting in this team",
            "type": "boolean"
          }
        },
        "required": [
          "require2fa",
          "members",
          "enrolled"
        ],
        "type": "object"
      },
      "TeamSettings": {
        "additionalProperties": false,
        "properties": {
          "buildLocation": {
            "enum": [
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "registryId": {
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "buildLocation",
          "registryId",
          "updatedAt"
        ],
        "type": "object"
      },
      "TemplateCatalog": {
        "additionalProperties": false,
        "properties": {
          "categories": {
            "items": {
              "$ref": "#/components/schemas/TemplateCategory"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/TemplateSummary"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "categories"
        ],
        "type": "object"
      },
      "TemplateCategory": {
        "additionalProperties": false,
        "properties": {
          "count": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "type": "string"
          },
          "label": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "label",
          "count"
        ],
        "type": "object"
      },
      "TemplateDatabase": {
        "additionalProperties": false,
        "properties": {
          "databaseName": {
            "type": "string"
          },
          "engine": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "engine",
          "version"
        ],
        "type": "object"
      },
      "TemplateDomain": {
        "additionalProperties": false,
        "properties": {
          "generate": {
            "type": "boolean"
          },
          "host": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TemplateFile": {
        "additionalProperties": false,
        "properties": {
          "content": {
            "type": "string"
          },
          "mode": {
            "type": "string"
          },
          "path": {
            "type": "string"
          }
        },
        "required": [
          "path",
          "content"
        ],
        "type": "object"
      },
      "TemplateHealth": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deadlineSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "intervalSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "path": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "startPeriodSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "successThreshold": {
            "format": "int64",
            "type": "integer"
          },
          "timeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "TemplateInput": {
        "additionalProperties": false,
        "properties": {
          "default": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "format": {
            "enum": [
              "text",
              "email",
              "url",
              "hostname",
              "number"
            ],
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "options": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "required": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          }
        },
        "required": [
          "key",
          "label",
          "default",
          "required",
          "secret"
        ],
        "type": "object"
      },
      "TemplateInstallRequest": {
        "additionalProperties": false,
        "properties": {
          "deploy": {
            "type": "boolean"
          },
          "inputs": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "name": {
            "maxLength": 120,
            "type": "string"
          },
          "serverId": {
            "type": "string"
          }
        },
        "required": [
          "serverId"
        ],
        "type": "object"
      },
      "TemplateInstallResult": {
        "additionalProperties": false,
        "properties": {
          "deployments": {
            "items": {
              "$ref": "#/components/schemas/DeploymentView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "instance": {
            "$ref": "#/components/schemas/TemplateInstance"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/ServiceView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "instance",
          "services",
          "deployments",
          "warnings"
        ],
        "type": "object"
      },
      "TemplateInstance": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "currentRevision": {
            "format": "int64",
            "type": "integer"
          },
          "currentVersion": {
            "type": "string"
          },
          "environmentId": {
            "type": "string"
          },
          "groupId": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "inputs": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "name": {
            "type": "string"
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/TemplateInstanceService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "templateId": {
            "type": "string"
          },
          "templateRevision": {
            "format": "int64",
            "type": "integer"
          },
          "templateVersion": {
            "type": "string"
          },
          "updateAvailable": {
            "type": "boolean"
          },
          "updateBlocked": {
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          }
        },
        "required": [
          "id",
          "environmentId",
          "templateId",
          "templateRevision",
          "templateVersion",
          "currentRevision",
          "currentVersion",
          "updateAvailable",
          "name",
          "groupId",
          "inputs",
          "services",
          "createdAt"
        ],
        "type": "object"
      },
      "TemplateInstanceService": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "key",
          "slug",
          "name"
        ],
        "type": "object"
      },
      "TemplateLimits": {
        "additionalProperties": false,
        "properties": {
          "cpus": {
            "format": "double",
            "type": "number"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          }
        },
        "type": "object"
      },
      "TemplateLinks": {
        "additionalProperties": false,
        "properties": {
          "docs": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "website": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TemplateOrigin": {
        "additionalProperties": false,
        "properties": {
          "commit": {
            "type": "string"
          },
          "license": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object"
      },
      "TemplatePlan": {
        "additionalProperties": false,
        "properties": {
          "checks": {
            "items": {
              "$ref": "#/components/schemas/TemplatePlanCheck"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "inputs": {
            "items": {
              "$ref": "#/components/schemas/TemplatePlanInput"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "installable": {
            "type": "boolean"
          },
          "proxyRestart": {
            "type": "boolean"
          },
          "secrets": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "services": {
            "items": {
              "$ref": "#/components/schemas/TemplatePlanService"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "template": {
            "$ref": "#/components/schemas/TemplateSummary"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "template",
          "services",
          "inputs",
          "secrets",
          "checks",
          "warnings",
          "installable",
          "proxyRestart"
        ],
        "type": "object"
      },
      "TemplatePlanCheck": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "status": {
            "enum": [
              "ok",
              "warn",
              "fail"
            ],
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "message"
        ],
        "type": "object"
      },
      "TemplatePlanInput": {
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "format": {
            "enum": [
              "text",
              "email",
              "url",
              "hostname",
              "number"
            ],
            "type": "string"
          },
          "generated": {
            "type": "boolean"
          },
          "key": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "options": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "required": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "label",
          "required",
          "secret",
          "generated"
        ],
        "type": "object"
      },
      "TemplatePlanPort": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "type": "string"
          },
          "publish": {
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "port",
          "protocol",
          "publish"
        ],
        "type": "object"
      },
      "TemplatePlanRequest": {
        "additionalProperties": false,
        "properties": {
          "inputs": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "serverId": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TemplatePlanService": {
        "additionalProperties": false,
        "properties": {
          "database": {
            "type": "string"
          },
          "dependsOn": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "domain": {
            "type": "string"
          },
          "files": {
            "format": "int64",
            "type": "integer"
          },
          "image": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "oneshot": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "ports": {
            "items": {
              "$ref": "#/components/schemas/TemplatePlanPort"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "slug": {
            "type": "string"
          },
          "volumes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "name",
          "slug",
          "kind",
          "volumes",
          "files",
          "ports",
          "oneshot",
          "dependsOn"
        ],
        "type": "object"
      },
      "TemplatePort": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "protocol": {
            "type": "string"
          },
          "publish": {
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "port",
          "protocol",
          "publish"
        ],
        "type": "object"
      },
      "TemplateRequires": {
        "additionalProperties": false,
        "properties": {
          "arch": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "diskGb": {
            "format": "int64",
            "type": "integer"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "memoryMb",
          "diskGb",
          "arch"
        ],
        "type": "object"
      },
      "TemplateService": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "database": {
            "$ref": "#/components/schemas/TemplateDatabase"
          },
          "dependsOn": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "digest": {
            "type": "string"
          },
          "docker": {
            "$ref": "#/components/schemas/DockerBlock"
          },
          "domains": {
            "items": {
              "$ref": "#/components/schemas/TemplateDomain"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "env": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "files": {
            "items": {
              "$ref": "#/components/schemas/TemplateFile"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "healthcheck": {
            "$ref": "#/components/schemas/TemplateHealth"
          },
          "image": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "oneshot": {
            "type": "boolean"
          },
          "port": {
            "format": "int64",
            "type": "integer"
          },
          "ports": {
            "items": {
              "$ref": "#/components/schemas/TemplatePort"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "resources": {
            "$ref": "#/components/schemas/TemplateLimits"
          },
          "secrets": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "stopGraceSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "volumes": {
            "items": {
              "$ref": "#/components/schemas/TemplateVolume"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "name",
          "kind"
        ],
        "type": "object"
      },
      "TemplateSummary": {
        "additionalProperties": false,
        "properties": {
          "category": {
            "type": "string"
          },
          "databases": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "heavy": {
            "type": "boolean"
          },
          "icon": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "license": {
            "type": "string"
          },
          "licenseClass": {
            "type": "string"
          },
          "licenseUrl": {
            "type": "string"
          },
          "memoryMb": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "publishesPorts": {
            "type": "boolean"
          },
          "requiresUnrestricted": {
            "type": "boolean"
          },
          "revision": {
            "format": "int64",
            "type": "integer"
          },
          "services": {
            "format": "int64",
            "type": "integer"
          },
          "summary": {
            "type": "string"
          },
          "tags": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "version": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "revision",
          "name",
          "summary",
          "category",
          "tags",
          "license",
          "licenseClass",
          "services",
          "databases",
          "memoryMb",
          "publishesPorts"
        ],
        "type": "object"
      },
      "TemplateUpdate": {
        "additionalProperties": false,
        "properties": {
          "applied": {
            "format": "int64",
            "type": "integer"
          },
          "apply": {
            "format": "int64",
            "type": "integer"
          },
          "available": {
            "type": "boolean"
          },
          "blocked": {
            "type": "string"
          },
          "changes": {
            "items": {
              "$ref": "#/components/schemas/TemplateUpdateChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "currentRevision": {
            "format": "int64",
            "type": "integer"
          },
          "currentVersion": {
            "type": "string"
          },
          "inputs": {
            "items": {
              "$ref": "#/components/schemas/TemplatePlanInput"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "installedRevision": {
            "format": "int64",
            "type": "integer"
          },
          "installedVersion": {
            "type": "string"
          },
          "instanceId": {
            "type": "string"
          },
          "kept": {
            "format": "int64",
            "type": "integer"
          },
          "manual": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "notes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "templateId": {
            "type": "string"
          }
        },
        "required": [
          "instanceId",
          "templateId",
          "name",
          "installedRevision",
          "installedVersion",
          "currentRevision",
          "currentVersion",
          "available",
          "changes",
          "inputs",
          "apply",
          "kept",
          "manual",
          "applied",
          "notes"
        ],
        "type": "object"
      },
      "TemplateUpdateChange": {
        "additionalProperties": false,
        "properties": {
          "field": {
            "type": "string"
          },
          "from": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "secret": {
            "type": "boolean"
          },
          "service": {
            "type": "string"
          },
          "serviceName": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          },
          "status": {
            "enum": [
              "apply",
              "applied",
              "kept",
              "manual"
            ],
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "service",
          "field",
          "from",
          "to",
          "secret",
          "status"
        ],
        "type": "object"
      },
      "TemplateUpdateRequest": {
        "additionalProperties": false,
        "properties": {
          "inputs": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "revision": {
            "format": "int64",
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "revision"
        ],
        "type": "object"
      },
      "TemplateUpdateResult": {
        "additionalProperties": false,
        "properties": {
          "changes": {
            "items": {
              "$ref": "#/components/schemas/TemplateUpdateChange"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "instance": {
            "$ref": "#/components/schemas/TemplateInstance"
          },
          "services": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "staged": {
            "format": "int64",
            "type": "integer"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "instance",
          "changes",
          "staged",
          "services",
          "warnings"
        ],
        "type": "object"
      },
      "TemplateUpstream": {
        "additionalProperties": false,
        "properties": {
          "class": {
            "type": "string"
          },
          "license": {
            "type": "string"
          },
          "licenseUrl": {
            "type": "string"
          }
        },
        "required": [
          "license",
          "class"
        ],
        "type": "object"
      },
      "TemplateVolume": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "type": "string"
          },
          "path": {
            "type": "string"
          }
        },
        "required": [
          "name",
          "path"
        ],
        "type": "object"
      },
      "TerminalInfoView": {
        "additionalProperties": false,
        "properties": {
          "activeSessions": {
            "description": "Terminal sessions the caller has open right now.",
            "format": "int64",
            "type": "integer"
          },
          "available": {
            "description": "A terminal can be opened now.",
            "type": "boolean"
          },
          "fileWrites": {
            "$ref": "#/components/schemas/FileWritePolicy"
          },
          "idleTimeoutSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "maxSessions": {
            "format": "int64",
            "type": "integer"
          },
          "maxUploadBytes": {
            "format": "int64",
            "type": "integer"
          },
          "previewBytes": {
            "format": "int64",
            "type": "integer"
          },
          "production": {
            "description": "The service runs in a production environment: opening a terminal needs confirmProduction.",
            "type": "boolean"
          },
          "reason": {
            "description": "Why not, when unavailable.",
            "type": "string"
          },
          "replicas": {
            "items": {
              "$ref": "#/components/schemas/ReplicaView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "serverName": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "available",
          "production",
          "replicas",
          "maxSessions",
          "activeSessions",
          "idleTimeoutSeconds",
          "fileWrites",
          "maxUploadBytes",
          "previewBytes"
        ],
        "type": "object"
      },
      "TerminalSettingsView": {
        "additionalProperties": false,
        "properties": {
          "allowProductionFileWrites": {
            "description": "Let the file browser upload files in production environments of this project (default off: read-only).",
            "type": "boolean"
          }
        },
        "required": [
          "allowProductionFileWrites"
        ],
        "type": "object"
      },
      "TestDestinationInputBody": {
        "additionalProperties": false,
        "properties": {
          "serverId": {
            "description": "The server whose agent performs the test (it is the one that talks to the destination).",
            "type": "string"
          }
        },
        "required": [
          "serverId"
        ],
        "type": "object"
      },
      "TestDrainInputBody": {
        "additionalProperties": false,
        "properties": {
          "serverId": {
            "description": "Send from this server. Default: the first connected one.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "TestInputBody": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "description": "Optional field or secret name to read",
            "maxLength": 255,
            "type": "string"
          },
          "path": {
            "description": "Optional secret path to read (without the integration name); for Doppler the project and config, like backend/prd, or empty for the integration's defaults",
            "maxLength": 512,
            "type": "string"
          }
        },
        "type": "object"
      },
      "TestIssuerBody": {
        "additionalProperties": false,
        "properties": {
          "authorizationEndpoint": {
            "description": "Where people are sent to sign in (on success)",
            "type": "string"
          },
          "code": {
            "description": "Why the issuer cannot be used (on failure)",
            "enum": [
              "invalid_issuer",
              "host_not_found",
              "unreachable",
              "timeout",
              "tls_invalid",
              "discovery_not_found",
              "discovery_invalid",
              "issuer_mismatch",
              "discovery_incomplete"
            ],
            "type": "string"
          },
          "issuer": {
            "description": "The issuer the provider reported (on success)",
            "type": "string"
          },
          "message": {
            "description": "What to fix (on failure)",
            "type": "string"
          },
          "ok": {
            "description": "The issuer serves a usable OpenID configuration",
            "type": "boolean"
          }
        },
        "required": [
          "ok"
        ],
        "type": "object"
      },
      "TestIssuerInputBody": {
        "additionalProperties": false,
        "properties": {
          "issuerUrl": {
            "description": "The OIDC issuer to read the discovery document of",
            "maxLength": 500,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "issuerUrl"
        ],
        "type": "object"
      },
      "TestResult": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "commitSha": {
            "description": "The branch head, when the test succeeded",
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "status": {
            "$ref": "#/components/schemas/StatusView"
          }
        },
        "required": [
          "ok",
          "status"
        ],
        "type": "object"
      },
      "TmpfsMount": {
        "additionalProperties": false,
        "properties": {
          "mode": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "sizeMb": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "path"
        ],
        "type": "object"
      },
      "Token": {
        "additionalProperties": false,
        "properties": {
          "allowProductionWithoutApproval": {
            "description": "MCP calls with this token skip the production approval. Set by an Owner or Admin when the token is created.",
            "type": "boolean"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "expiresAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "lastUsedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "prefix": {
            "description": "First 8 characters after nct_, for identification",
            "type": "string"
          },
          "projectIds": {
            "description": "Absent when the token can access all projects",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requireProductionApproval": {
            "description": "Calls with this token on production environments need a human approval first (REST tokens are exempt by default so CI keeps working).",
            "type": "boolean"
          },
          "revokedAt": {
            "format": "date-time",
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "name",
          "prefix",
          "scopes",
          "createdAt",
          "allowProductionWithoutApproval",
          "requireProductionApproval"
        ],
        "type": "object"
      },
      "TopItem": {
        "additionalProperties": false,
        "properties": {
          "avgMs": {
            "format": "double",
            "type": "number"
          },
          "bytesOut": {
            "format": "int64",
            "type": "integer"
          },
          "k": {
            "type": "string"
          },
          "n": {
            "format": "int64",
            "type": "integer"
          },
          "s5xx": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "k",
          "n"
        ],
        "type": "object"
      },
      "TotpDisableInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "description": "A current authenticator code or a recovery code",
            "maxLength": 40,
            "minLength": 6,
            "type": "string"
          },
          "password": {
            "description": "Required when the account has a password",
            "maxLength": 256,
            "type": "string"
          }
        },
        "required": [
          "code"
        ],
        "type": "object"
      },
      "TotpEnableInputBody": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "maxLength": 10,
            "minLength": 6,
            "type": "string"
          }
        },
        "required": [
          "code"
        ],
        "type": "object"
      },
      "TotpSetupOutputBody": {
        "additionalProperties": false,
        "properties": {
          "secret": {
            "description": "Base32 secret for manual entry",
            "type": "string"
          },
          "uri": {
            "description": "otpauth:// URI for authenticator apps",
            "type": "string"
          }
        },
        "required": [
          "secret",
          "uri"
        ],
        "type": "object"
      },
      "TunnelView": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "type": "string"
          },
          "accountReady": {
            "description": "The connection has an account ID (needed for tunnels)",
            "type": "boolean"
          },
          "active": {
            "type": "boolean"
          },
          "agentSupported": {
            "description": "The server's agent can run the cloudflared connector",
            "type": "boolean"
          },
          "cloudflareConnected": {
            "description": "The team has a Cloudflare connection",
            "type": "boolean"
          },
          "cname": {
            "description": "The DNS target of the tunnel: \u003ctunnelId\u003e.cfargotunnel.com",
            "type": "string"
          },
          "connections": {
            "description": "Ready connections to Cloudflare's edge",
            "format": "int64",
            "type": "integer"
          },
          "enabled": {
            "description": "The server has a tunnel (or is removing one)",
            "type": "boolean"
          },
          "image": {
            "type": "string"
          },
          "ingressError": {
            "type": "string"
          },
          "ingressHosts": {
            "format": "int64",
            "type": "integer"
          },
          "ingressSyncedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "message": {
            "description": "Why the connector needs attention, or the last teardown problem",
            "type": "string"
          },
          "observedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "state": {
            "description": "Observed connector state; off when the server has no tunnel",
            "enum": [
              "off",
              "provisioning",
              "online",
              "offline",
              "needs_attention",
              "removing"
            ],
            "type": "string"
          },
          "tunnelId": {
            "type": "string"
          },
          "tunnelName": {
            "type": "string"
          },
          "upstream": {
            "description": "Where the tunnel forwards every request",
            "type": "string"
          }
        },
        "required": [
          "enabled",
          "state",
          "message",
          "active",
          "connections",
          "observedAt",
          "ingressHosts",
          "ingressSyncedAt",
          "cloudflareConnected",
          "accountReady",
          "agentSupported",
          "upstream"
        ],
        "type": "object"
      },
      "Ulimit": {
        "additionalProperties": false,
        "properties": {
          "hard": {
            "format": "int64",
            "type": "integer"
          },
          "name": {
            "enum": [
              "nofile",
              "memlock"
            ],
            "type": "string"
          },
          "soft": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "name",
          "soft",
          "hard"
        ],
        "type": "object"
      },
      "UnrestrictedSettings": {
        "additionalProperties": false,
        "properties": {
          "available": {
            "description": "The agent can run Compose stacks (Docker Compose plugin 2.24 or newer)",
            "type": "boolean"
          },
          "composeVersion": {
            "description": "Docker Compose plugin version the agent reported, empty when it has none",
            "type": "string"
          },
          "dockerServices": {
            "description": "Live services placed on this server that use Docker options which need an unrestricted server",
            "format": "int64",
            "type": "integer"
          },
          "stacks": {
            "description": "Live Compose stacks placed on this server",
            "format": "int64",
            "type": "integer"
          },
          "unrestricted": {
            "description": "An instance admin allowed this server to run stacks and services with privileged mode, host networking, devices, GPUs, a runtime, the host PID namespace, unconfined seccomp or AppArmor, NET_ADMIN, SYS_ADMIN, the Docker socket and host bind mounts",
            "type": "boolean"
          }
        },
        "required": [
          "unrestricted",
          "composeVersion",
          "available",
          "stacks",
          "dockerServices"
        ],
        "type": "object"
      },
      "Unrouted": {
        "additionalProperties": false,
        "properties": {
          "hosts": {
            "items": {
              "$ref": "#/components/schemas/TopItem"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "requests": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "requests",
          "hosts"
        ],
        "type": "object"
      },
      "UpdateCleanupInputBody": {
        "additionalProperties": false,
        "properties": {
          "buildCacheMinAgeDays": {
            "description": "Prune build cache older than this many days (1-365). 0 or omitted keeps the default, 7.",
            "format": "int64",
            "maximum": 365,
            "minimum": 0,
            "type": "integer"
          },
          "cron": {
            "description": "The schedule: a 5-field cron expression (or @daily, @weekly, ...) evaluated in UTC. Runs must be at least 15 minutes apart. Empty keeps the default, 0 4 * * *.",
            "type": "string"
          },
          "diskTriggerPercent": {
            "description": "Start an emergency cleanup when disk usage reaches this percent (50-99). 0 or omitted follows the server's disk alert threshold.",
            "format": "int64",
            "maximum": 99,
            "minimum": 0,
            "type": "integer"
          },
          "enabled": {
            "description": "Run the scheduled (daily, 04:00 UTC) and emergency cleanups",
            "type": "boolean"
          },
          "removeStoppedUnmanaged": {
            "description": "Also remove stopped containers that NebulaCtrl does not manage. Their volumes are kept.",
            "type": "boolean"
          },
          "unusedImageMinAgeHours": {
            "description": "Remove unused images older than this many hours (1-8760). 0 or omitted keeps the default, 72.",
            "format": "int64",
            "maximum": 8760,
            "minimum": 0,
            "type": "integer"
          }
        },
        "required": [
          "enabled",
          "removeStoppedUnmanaged"
        ],
        "type": "object"
      },
      "UpdateConnectionInputBody": {
        "additionalProperties": false,
        "properties": {
          "clientSecret": {
            "description": "Write-only; replaces the OAuth client secret",
            "maxLength": 512,
            "type": "string"
          },
          "name": {
            "maxLength": 80,
            "type": "string"
          },
          "token": {
            "description": "Write-only; replaces the access token",
            "maxLength": 512,
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateCredentialInputBody": {
        "additionalProperties": false,
        "properties": {
          "clear": {
            "description": "Optional variables to remove",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "name": {
            "maxLength": 80,
            "minLength": 1,
            "type": "string"
          },
          "values": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Replaces the named variables; an empty value keeps the stored one",
            "type": "object"
          }
        },
        "type": "object"
      },
      "UpdateDashboardAccessInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "description": "CIDRs or single addresses (IPv4 or IPv6) allowed to reach the dashboard. Empty lifts the restriction.",
            "items": {
              "type": "string"
            },
            "maxItems": 200,
            "type": [
              "array",
              "null"
            ]
          },
          "confirmLockout": {
            "description": "Save even though allowCidrs excludes the caller's current address (otherwise 409 dashboard_lockout).",
            "type": "boolean"
          },
          "dnsResolver": {
            "description": "DNS-01 provider of the dashboard's certificate (a resolver the control-plane server already has, see resolverAvailable). Empty is automatic HTTP-01.",
            "type": "string"
          }
        },
        "required": [
          "allowCidrs"
        ],
        "type": "object"
      },
      "UpdateEnvironmentInputBody": {
        "additionalProperties": false,
        "properties": {
          "isProduction": {
            "type": "boolean"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateInputBody": {
        "additionalProperties": false,
        "properties": {
          "addPrefix": {
            "description": "Prepend this path before forwarding to the service",
            "maxLength": 200,
            "type": "string"
          },
          "certificateId": {
            "description": "An uploaded certificate of the service's server whose names cover the hostname; empty clears the pin",
            "type": "string"
          },
          "dnsResolver": {
            "description": "DNS-01 provider (a lego provider code) that obtains the certificate; the server must have a resolver for it. Empty = HTTP-01 or a covering wildcard certificate",
            "pattern": "^([a-z0-9][a-z0-9-]{0,39})?$",
            "type": "string"
          },
          "hostname": {
            "maxLength": 253,
            "minLength": 3,
            "type": "string"
          },
          "kind": {
            "description": "serve routes to the service; redirect answers with a redirect to redirectTo",
            "enum": [
              "serve",
              "redirect"
            ],
            "type": "string"
          },
          "options": {
            "$ref": "#/components/schemas/RouteOptions",
            "description": "Replaces the whole option set"
          },
          "pathPrefix": {
            "description": "Serve only this path (and below), e.g. /api. Empty = the whole host",
            "maxLength": 200,
            "type": "string"
          },
          "preservePath": {
            "description": "A redirect keeps the request path and query (default true)",
            "type": "boolean"
          },
          "redirectCode": {
            "enum": [
              301,
              302,
              307,
              308
            ],
            "format": "int64",
            "type": "integer"
          },
          "redirectTo": {
            "description": "Target hostname of a redirect (not a URL)",
            "maxLength": 253,
            "type": "string"
          },
          "stripPrefix": {
            "description": "Remove the path prefix before forwarding to the service",
            "type": "boolean"
          },
          "tlsMode": {
            "description": "auto = ACME or the default certificate, custom = an uploaded certificate, none = plain HTTP only",
            "enum": [
              "auto",
              "custom",
              "none"
            ],
            "type": "string"
          },
          "wwwRedirect": {
            "description": "true creates (false removes) a whole-host 301 redirect from the www/apex counterpart of this hostname (www.\u003chost\u003e, or the host without www.) to this domain. Both hostnames are routed and get certificates; each needs its own DNS record. Needs a whole-host serve domain (422 invalid_www_redirect)",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "UpdateInstanceInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowTeamCreation": {
            "type": "boolean"
          },
          "smtpFrom": {
            "maxLength": 254,
            "type": "string"
          },
          "smtpHost": {
            "maxLength": 253,
            "type": "string"
          },
          "smtpInsecureSkipVerify": {
            "type": "boolean"
          },
          "smtpPassword": {
            "description": "Write-only. Empty clears it.",
            "maxLength": 1024,
            "type": "string"
          },
          "smtpPort": {
            "format": "int64",
            "maximum": 65535,
            "minimum": 1,
            "type": "integer"
          },
          "smtpTls": {
            "enum": [
              "implicit",
              "starttls",
              "none"
            ],
            "type": "string"
          },
          "smtpUsername": {
            "maxLength": 254,
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateMeInputBody": {
        "additionalProperties": false,
        "properties": {
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "type": "object"
      },
      "UpdateMemberInputBody": {
        "additionalProperties": false,
        "properties": {
          "allProjects": {
            "description": "true lifts the project restriction",
            "type": "boolean"
          },
          "projectIds": {
            "description": "Restrict the member to these projects (developer and viewer only); an empty list sees no project",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "role": {
            "enum": [
              "owner",
              "admin",
              "developer",
              "viewer"
            ],
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateProjectInputBody": {
        "additionalProperties": false,
        "properties": {
          "buildLocation": {
            "description": "Where this project's git services are built: inherit (team default), target, or build_server. Sets buildServerId and registryId with it (omitted = cleared).",
            "enum": [
              "inherit",
              "target",
              "build_server"
            ],
            "type": "string"
          },
          "buildServerId": {
            "description": "Pin the build server; omitted lets the control plane choose a sticky one. Only with buildLocation.",
            "type": "string"
          },
          "description": {
            "maxLength": 500,
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "registryId": {
            "description": "Registry the builds are pushed to; omitted inherits the team default. Only with buildLocation.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateRouteInputBody": {
        "additionalProperties": false,
        "properties": {
          "allowCidrs": {
            "description": "tcp routes: client networks allowed; UDP cannot be restricted",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "denyCidrs": {
            "description": "tcp routes: client networks refused first, even when allowCidrs admits them; UDP cannot be restricted",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "healthPath": {
            "description": "Enables a proxy health check on this path",
            "maxLength": 200,
            "type": "string"
          },
          "insecureSkipVerify": {
            "description": "https upstreams: do not verify the upstream certificate",
            "type": "boolean"
          },
          "listenPort": {
            "description": "tcp/udp routes: host port on the server (1024-65535)",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "openToInternet": {
            "description": "tcp/udp routes: required when allowCidrs is empty",
            "type": "boolean"
          },
          "passHost": {
            "description": "false rewrites the Host header to the upstream's (default true)",
            "type": "boolean"
          },
          "proxyProtocol": {
            "description": "tcp routes: PROXY protocol version sent to the upstream",
            "enum": [
              0,
              1,
              2
            ],
            "format": "int64",
            "type": "integer"
          },
          "scheme": {
            "description": "http routes: scheme used towards the upstream",
            "enum": [
              "http",
              "https"
            ],
            "type": "string"
          },
          "serverName": {
            "description": "https upstreams: TLS server name",
            "maxLength": 253,
            "type": "string"
          },
          "upstreams": {
            "description": "1-20 upstreams",
            "items": {
              "$ref": "#/components/schemas/UpstreamInput"
            },
            "type": "array"
          },
          "verifySkip": {
            "description": "Skip the post-deploy HTTP verification (upstreams that legitimately answer 5xx)",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "UpdateServerInputBody": {
        "additionalProperties": false,
        "properties": {
          "acceptWorkloads": {
            "description": "false stops new services being scheduled on this server (what already runs here keeps running); default true",
            "type": "boolean"
          },
          "acmeEmail": {
            "description": "Empty string clears",
            "maxLength": 254,
            "type": "string"
          },
          "baseDomain": {
            "description": "Empty string clears",
            "maxLength": 253,
            "type": "string"
          },
          "buildAllowEmulation": {
            "description": "Allow cross-architecture builds through emulation (default off)",
            "type": "boolean"
          },
          "buildAllowPreviews": {
            "description": "Let pull request previews build on this server (default off: previews build on their own server)",
            "type": "boolean"
          },
          "buildEnabled": {
            "description": "Make the server a build server: it builds git sources for other servers and pushes the images to a registry. Combine with acceptWorkloads: Deployments (true/false), Builds (false/true) or Both (true/true).",
            "type": "boolean"
          },
          "buildMaxConcurrent": {
            "description": "Parallel builds on this server (default 2); more queue on the control plane",
            "format": "int64",
            "maximum": 16,
            "minimum": 1,
            "type": "integer"
          },
          "diskAlertThresholdPercent": {
            "description": "Disk usage percent that raises the disk alert (default 80)",
            "format": "int64",
            "maximum": 99,
            "minimum": 50,
            "type": "integer"
          },
          "geoEnabled": {
            "description": "Count where requests come from (default on); needs traffic analytics",
            "type": "boolean"
          },
          "geoLevel": {
            "description": "country (default, ~8 MB database) or city (~130 MB)",
            "enum": [
              "country",
              "city"
            ],
            "type": "string"
          },
          "geoRefreshDays": {
            "description": "Check for a newer database every N days (default 7)",
            "format": "int64",
            "maximum": 90,
            "minimum": 1,
            "type": "integer"
          },
          "geoSource": {
            "description": "dbip = DB-IP Lite (default, no key); maxmind = MaxMind GeoLite2 (needs the team's account, see PUT /geo/maxmind)",
            "enum": [
              "dbip",
              "maxmind"
            ],
            "type": "string"
          },
          "metricsRetentionDays": {
            "description": "Days of resource metric history (default 7)",
            "format": "int64",
            "maximum": 90,
            "minimum": 1,
            "type": "integer"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "publicIp": {
            "description": "Empty string clears",
            "maxLength": 45,
            "type": "string"
          },
          "trafficAnalyticsEnabled": {
            "description": "Turns Traefik access-log analytics on or off (default on)",
            "type": "boolean"
          },
          "trafficDailyRetentionDays": {
            "description": "Days of daily traffic history (default 90)",
            "format": "int64",
            "maximum": 365,
            "minimum": 7,
            "type": "integer"
          },
          "trafficHourlyRetentionDays": {
            "description": "Days of hourly traffic history (default 7)",
            "format": "int64",
            "maximum": 90,
            "minimum": 2,
            "type": "integer"
          }
        },
        "type": "object"
      },
      "UpdateServiceInputBody": {
        "additionalProperties": false,
        "properties": {
          "config": {
            "$ref": "#/components/schemas/ConfigInput",
            "description": "Replaces the whole config; omitted fields take defaults"
          },
          "gitToken": {
            "description": "Write-only; an empty string clears the token",
            "type": "string"
          },
          "name": {
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          },
          "registryAuth": {
            "$ref": "#/components/schemas/RegistryAuthInput",
            "description": "Write-only; empty username and password clears the credentials"
          },
          "serverId": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpdateSettingsInputBody": {
        "additionalProperties": false,
        "properties": {
          "ports": {
            "$ref": "#/components/schemas/PortsStruct"
          },
          "tailnet": {
            "$ref": "#/components/schemas/TailnetStruct"
          },
          "upstreamPolicy": {
            "$ref": "#/components/schemas/UpstreamPolicyStruct"
          }
        },
        "type": "object"
      },
      "UpdateWildcardInputBody": {
        "additionalProperties": false,
        "properties": {
          "coverGenerated": {
            "type": "boolean"
          },
          "default": {
            "type": "boolean"
          },
          "includeApex": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "UpgradeInputBody": {
        "additionalProperties": false,
        "properties": {
          "confirm": {
            "description": "Must equal the service slug",
            "type": "string"
          },
          "targetVersion": {
            "maxLength": 16,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "targetVersion",
          "confirm"
        ],
        "type": "object"
      },
      "UpgradePlan": {
        "additionalProperties": false,
        "properties": {
          "blockers": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "downtime": {
            "type": "string"
          },
          "engine": {
            "type": "string"
          },
          "executable": {
            "type": "boolean"
          },
          "from": {
            "type": "string"
          },
          "helperImage": {
            "type": "string"
          },
          "image": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "steps": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "to": {
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "engine",
          "from",
          "to",
          "kind",
          "method",
          "steps",
          "warnings",
          "blockers",
          "downtime",
          "executable"
        ],
        "type": "object"
      },
      "UpgradePlanInputBody": {
        "additionalProperties": false,
        "properties": {
          "targetVersion": {
            "maxLength": 16,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "targetVersion"
        ],
        "type": "object"
      },
      "UpgradeReport": {
        "additionalProperties": false,
        "properties": {
          "at": {
            "format": "date-time",
            "type": "string"
          },
          "from": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "state": {
            "type": "string"
          },
          "to": {
            "type": "string"
          }
        },
        "required": [
          "state",
          "from",
          "to",
          "at"
        ],
        "type": "object"
      },
      "UpgradeResult": {
        "additionalProperties": false,
        "properties": {
          "commandId": {
            "type": "string"
          },
          "plan": {
            "$ref": "#/components/schemas/UpgradePlan"
          },
          "status": {
            "enum": [
              "staged",
              "pending"
            ],
            "type": "string"
          },
          "upgradeId": {
            "type": "string"
          }
        },
        "required": [
          "plan",
          "status"
        ],
        "type": "object"
      },
      "UpgradeView": {
        "additionalProperties": false,
        "properties": {
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "fromVersion": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "newVolume": {
            "type": "string"
          },
          "oldVolume": {
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "ready",
              "failed"
            ],
            "type": "string"
          },
          "toVersion": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "method",
          "fromVersion",
          "toVersion",
          "oldVolume",
          "newVolume",
          "status",
          "createdAt"
        ],
        "type": "object"
      },
      "UploadCertificateInputBody": {
        "additionalProperties": false,
        "properties": {
          "certPem": {
            "description": "ServerCertificate chain in PEM, leaf first",
            "maxLength": 65536,
            "minLength": 1,
            "type": "string"
          },
          "keyPem": {
            "description": "Unencrypted private key in PEM. Write-only: sealed at rest, never returned.",
            "maxLength": 65536,
            "minLength": 1,
            "type": "string"
          },
          "name": {
            "description": "Unique per server",
            "maxLength": 100,
            "minLength": 1,
            "type": "string"
          }
        },
        "required": [
          "name",
          "certPem",
          "keyPem"
        ],
        "type": "object"
      },
      "UpstreamInput": {
        "additionalProperties": false,
        "properties": {
          "address": {
            "description": "External host:port, e.g. 192.168.1.20:8080",
            "maxLength": 300,
            "type": "string"
          },
          "port": {
            "description": "Container port of the managed service",
            "format": "int64",
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "serviceId": {
            "description": "A managed service of the same environment on the route's server",
            "type": "string"
          }
        },
        "type": "object"
      },
      "UpstreamPolicyStruct": {
        "additionalProperties": false,
        "properties": {
          "allowHostGateway": {
            "type": "boolean"
          },
          "allowLinkLocal": {
            "description": "Administrators only",
            "type": "boolean"
          },
          "allowLoopback": {
            "description": "Administrators only",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "UsageOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/VariableUsage"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "UsersOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/PlatformUserView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "ValidateVariableInput": {
        "additionalProperties": false,
        "properties": {
          "isSecret": {
            "type": "boolean"
          },
          "key": {
            "description": "Name of the variable being edited (defaults to a placeholder)",
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        },
        "required": [
          "value"
        ],
        "type": "object"
      },
      "ValidateVariableResult": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "containsSecret": {
            "description": "The value is or becomes secret (declared, a secret generator, or a secret reference)",
            "type": "boolean"
          },
          "error": {
            "$ref": "#/components/schemas/SyntaxProblem"
          },
          "generators": {
            "items": {
              "$ref": "#/components/schemas/GeneratorCall"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "message": {
            "type": "string"
          },
          "ok": {
            "type": "boolean"
          },
          "preview": {
            "description": "The resolved value for non-secret drafts",
            "type": "string"
          },
          "references": {
            "items": {
              "$ref": "#/components/schemas/RefCheck"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/VariableWarning"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "ok",
          "warnings",
          "references",
          "generators",
          "containsSecret"
        ],
        "type": "object"
      },
      "Variable": {
        "additionalProperties": false,
        "properties": {
          "ageDays": {
            "format": "int64",
            "type": "integer"
          },
          "comment": {
            "type": "string"
          },
          "computedSecret": {
            "type": "boolean"
          },
          "generated": {
            "description": "Generator descriptors of a generated variable (never the template text)",
            "items": {
              "$ref": "#/components/schemas/GeneratorCall"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "isSecret": {
            "type": "boolean"
          },
          "key": {
            "type": "string"
          },
          "problem": {
            "description": "Why the variable does not resolve right now",
            "type": "string"
          },
          "references": {
            "items": {
              "$ref": "#/components/schemas/VariableReference"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "rotateEveryDays": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "rotationDue": {
            "type": "boolean"
          },
          "scope": {
            "enum": [
              "runtime",
              "build",
              "both"
            ],
            "type": "string"
          },
          "set": {
            "type": "boolean"
          },
          "source": {
            "enum": [
              "manual",
              "generated",
              "imported",
              "suggested",
              "template"
            ],
            "type": "string"
          },
          "updatedAt": {
            "format": "date-time",
            "type": "string"
          },
          "value": {
            "description": "Omitted for secrets",
            "type": "string"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "key",
          "isSecret",
          "computedSecret",
          "set",
          "source",
          "scope",
          "version",
          "comment",
          "generated",
          "references",
          "rotateEveryDays",
          "ageDays",
          "rotationDue",
          "updatedAt"
        ],
        "type": "object"
      },
      "VariableHistoryEntry": {
        "additionalProperties": false,
        "properties": {
          "actorId": {
            "type": "string"
          },
          "actorType": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "fingerprint": {
            "description": "8 hex characters of an HMAC of the value: equal fingerprints mean equal values",
            "type": "string"
          },
          "generated": {
            "items": {
              "$ref": "#/components/schemas/GeneratorCall"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "isSecret": {
            "type": "boolean"
          },
          "op": {
            "enum": [
              "set",
              "delete",
              "rotate",
              "restore"
            ],
            "type": "string"
          },
          "releaseId": {
            "description": "The release that first shipped this version",
            "type": [
              "string",
              "null"
            ]
          },
          "restorable": {
            "type": "boolean"
          },
          "scope": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "value": {
            "description": "Non-secret values only",
            "type": "string"
          },
          "version": {
            "format": "int64",
            "type": "integer"
          }
        },
        "required": [
          "version",
          "op",
          "isSecret",
          "source",
          "scope",
          "fingerprint",
          "generated",
          "actorType",
          "releaseId",
          "createdAt",
          "restorable"
        ],
        "type": "object"
      },
      "VariableInput": {
        "additionalProperties": false,
        "properties": {
          "comment": {
            "maxLength": 1000,
            "type": "string"
          },
          "isSecret": {
            "type": "boolean"
          },
          "key": {
            "maxLength": 255,
            "minLength": 1,
            "type": "string"
          },
          "rotateEveryDays": {
            "description": "Reminder only; 0 clears it. Rotation is never automatic.",
            "format": "int64",
            "minimum": 0,
            "type": "integer"
          },
          "scope": {
            "enum": [
              "runtime",
              "build",
              "both"
            ],
            "type": "string"
          },
          "source": {
            "enum": [
              "suggested"
            ],
            "type": "string"
          },
          "value": {
            "description": "Omit to keep the stored value (secrets are write-only). May contain generators such as ${{secret(32)}}: they run once, and the same text again keeps the value.",
            "type": "string"
          }
        },
        "required": [
          "key"
        ],
        "type": "object"
      },
      "VariableList": {
        "additionalProperties": false,
        "properties": {
          "exports": {
            "items": {
              "$ref": "#/components/schemas/ExportVar"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/Variable"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "platform": {
            "items": {
              "$ref": "#/components/schemas/PlatformVar"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "restaged": {
            "items": {
              "$ref": "#/components/schemas/RestagedServiceRef"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "$ref": "#/components/schemas/VariableWarning"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items",
          "platform",
          "exports",
          "warnings",
          "restaged"
        ],
        "type": "object"
      },
      "VariableReference": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "ns": {
            "description": "Service slug, shared, or empty for the same service",
            "type": "string"
          }
        },
        "required": [
          "key"
        ],
        "type": "object"
      },
      "VariableRotateBody": {
        "additionalProperties": false,
        "properties": {
          "dryRun": {
            "description": "true returns the plan and changes nothing; false stages the new value (nothing is deployed)",
            "type": "boolean"
          }
        },
        "required": [
          "dryRun"
        ],
        "type": "object"
      },
      "VariableRotationPlan": {
        "additionalProperties": false,
        "properties": {
          "affected": {
            "items": {
              "$ref": "#/components/schemas/RotationAffected"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "blockers": {
            "items": {
              "$ref": "#/components/schemas/RotationBlocker"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "deployOrder": {
            "description": "Service slugs, providers first",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "key": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "app-secret",
              "engine-bound"
            ],
            "type": "string"
          },
          "staged": {
            "type": "boolean"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "key",
          "kind",
          "affected",
          "deployOrder",
          "warnings",
          "blockers",
          "staged"
        ],
        "type": "object"
      },
      "VariableUsage": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "slug": {
            "type": "string"
          }
        },
        "required": [
          "serviceId",
          "slug",
          "key"
        ],
        "type": "object"
      },
      "VariableWarning": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "type": "string"
          },
          "key": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "VersionView": {
        "additionalProperties": false,
        "properties": {
          "default": {
            "type": "boolean"
          },
          "id": {
            "type": "string"
          },
          "label": {
            "type": "string"
          },
          "notes": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "label",
          "default"
        ],
        "type": "object"
      },
      "View": {
        "additionalProperties": false,
        "properties": {
          "aclManagedWarning": {
            "description": "Shown while managed mode is on for Tailscale",
            "type": "string"
          },
          "aclMessage": {
            "type": "string"
          },
          "aclMode": {
            "enum": [
              "managed",
              "advisory",
              "off"
            ],
            "type": "string"
          },
          "aclState": {
            "enum": [
              "unknown",
              "applied",
              "pending",
              "drift",
              "advisory",
              "error"
            ],
            "type": "string"
          },
          "autoJoin": {
            "description": "Online servers with a current agent join the mesh automatically (each adds one device)",
            "type": "boolean"
          },
          "coordinator": {
            "$ref": "#/components/schemas/CoordinatorView"
          },
          "devices": {
            "$ref": "#/components/schemas/DevicesView"
          },
          "enabled": {
            "description": "At least one server joined the mesh (turned on by the first server)",
            "type": "boolean"
          },
          "links": {
            "items": {
              "$ref": "#/components/schemas/MeshLinkView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "loginServer": {
            "type": "string"
          },
          "managedPushAvailable": {
            "description": "The credential can write the tailnet policy (Tailscale OAuth with the policy_file scope, or a Headscale API key)",
            "type": "boolean"
          },
          "meshTag": {
            "description": "The one tag every mesh node of the team carries; it needs a tagOwners entry on Tailscale",
            "type": "string"
          },
          "nodes": {
            "items": {
              "$ref": "#/components/schemas/NodeView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "paused": {
            "description": "Mesh changes wait (the platform Headscale is being migrated); established connections keep working",
            "type": "boolean"
          },
          "pausedReason": {
            "type": "string"
          },
          "provider": {
            "enum": [
              "tailscale",
              "headscale",
              "none"
            ],
            "type": "string"
          },
          "rules": {
            "description": "The access rules NebulaCtrl generates (read-only)",
            "items": {
              "$ref": "#/components/schemas/RuleView"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "snippet": {
            "description": "The rules to add to the tailnet policy (advisory mode)",
            "type": "string"
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "enabled",
          "autoJoin",
          "paused",
          "pausedReason",
          "provider",
          "loginServer",
          "meshTag",
          "aclMode",
          "aclState",
          "aclMessage",
          "managedPushAvailable",
          "coordinator",
          "nodes",
          "links",
          "rules",
          "devices",
          "warnings"
        ],
        "type": "object"
      },
      "Viewport": {
        "additionalProperties": false,
        "properties": {
          "x": {
            "format": "double",
            "type": "number"
          },
          "y": {
            "format": "double",
            "type": "number"
          },
          "zoom": {
            "format": "double",
            "type": "number"
          }
        },
        "required": [
          "x",
          "y",
          "zoom"
        ],
        "type": "object"
      },
      "Violation": {
        "additionalProperties": false,
        "properties": {
          "key": {
            "type": "string"
          },
          "kind": {
            "enum": [
              "unsupported",
              "restricted"
            ],
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "service": {
            "type": "string"
          }
        },
        "required": [
          "key",
          "message",
          "kind"
        ],
        "type": "object"
      },
      "VolumeBackupConfigInput": {
        "additionalProperties": false,
        "properties": {
          "cron": {
            "description": "5-field cron expression or @hourly/@daily/@weekly/@monthly/@yearly; empty = manual backups only. At most one run every 5 minutes.",
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "enabled": {
            "description": "Run on the schedule (needs a cron).",
            "type": "boolean"
          },
          "excludes": {
            "description": "restic --exclude patterns relative to /vol, e.g. data/cache/**.",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "type": [
              "array",
              "null"
            ]
          },
          "freezeBudgetSeconds": {
            "description": "Longest pause of mode freeze (default 5). Over budget the copy is abandoned and the container thawed.",
            "format": "int64",
            "maximum": 60,
            "minimum": 1,
            "type": "integer"
          },
          "keepDaily": {
            "description": "Keep the newest backup of each of the last N days (default 7, 0 = no limit).",
            "format": "int64",
            "maximum": 3650,
            "minimum": 0,
            "type": "integer"
          },
          "keepMonthly": {
            "description": "Default 6, 0 = no limit. With all three at 0 nothing is ever removed.",
            "format": "int64",
            "maximum": 120,
            "minimum": 0,
            "type": "integer"
          },
          "keepWeekly": {
            "description": "Default 4, 0 = no limit.",
            "format": "int64",
            "maximum": 520,
            "minimum": 0,
            "type": "integer"
          },
          "mode": {
            "default": "freeze",
            "description": "freeze pauses the container while the local copy is taken (default); stop stops it; live copies nothing and may be inconsistent.",
            "enum": [
              "freeze",
              "stop",
              "live"
            ],
            "type": "string"
          },
          "postHook": {
            "$ref": "#/components/schemas/VolumeBackupHook",
            "description": "Runs inside the container after it was thawed."
          },
          "preHook": {
            "$ref": "#/components/schemas/VolumeBackupHook",
            "description": "Runs inside the container before the freeze, e.g. a database dump into the volume."
          },
          "timezone": {
            "description": "IANA zone, default UTC.",
            "type": "string"
          }
        },
        "required": [
          "destinationId"
        ],
        "type": "object"
      },
      "VolumeBackupConfigView": {
        "additionalProperties": false,
        "properties": {
          "configured": {
            "type": "boolean"
          },
          "cron": {
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "destinationKind": {
            "enum": [
              "s3",
              "local"
            ],
            "type": "string"
          },
          "destinationName": {
            "type": "string"
          },
          "eligible": {
            "type": "boolean"
          },
          "enabled": {
            "type": "boolean"
          },
          "excludes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "freezeBudgetSeconds": {
            "format": "int64",
            "type": "integer"
          },
          "ineligibleReason": {
            "type": "string"
          },
          "keepDaily": {
            "format": "int64",
            "type": "integer"
          },
          "keepMonthly": {
            "format": "int64",
            "type": "integer"
          },
          "keepWeekly": {
            "format": "int64",
            "type": "integer"
          },
          "lastRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "mode": {
            "enum": [
              "freeze",
              "stop",
              "live"
            ],
            "type": "string"
          },
          "nextRunAt": {
            "format": "date-time",
            "type": "string"
          },
          "postHook": {
            "$ref": "#/components/schemas/VolumeBackupHook"
          },
          "preHook": {
            "$ref": "#/components/schemas/VolumeBackupHook"
          },
          "repoReady": {
            "description": "A repository password exists for this destination.",
            "type": "boolean"
          },
          "serviceId": {
            "type": "string"
          },
          "timezone": {
            "type": "string"
          },
          "volumes": {
            "items": {
              "$ref": "#/components/schemas/VolumeBackupVolumeRef"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "serviceId",
          "configured",
          "eligible",
          "volumes",
          "mode",
          "freezeBudgetSeconds",
          "excludes",
          "keepDaily",
          "keepWeekly",
          "keepMonthly",
          "cron",
          "timezone",
          "enabled",
          "repoReady"
        ],
        "type": "object"
      },
      "VolumeBackupHook": {
        "additionalProperties": false,
        "properties": {
          "command": {
            "description": "The argv, run without a shell.",
            "items": {
              "type": "string"
            },
            "maxItems": 64,
            "minItems": 1,
            "type": [
              "array",
              "null"
            ]
          },
          "continueOnError": {
            "description": "A failing pre-hook becomes a warning instead of aborting the backup.",
            "type": "boolean"
          },
          "timeoutSeconds": {
            "description": "Default 300.",
            "format": "int64",
            "maximum": 3600,
            "minimum": 1,
            "type": "integer"
          },
          "user": {
            "description": "User inside the container (default: the container's user).",
            "maxLength": 128,
            "type": "string"
          }
        },
        "required": [
          "command"
        ],
        "type": "object"
      },
      "VolumeBackupListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/VolumeBackupView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "VolumeBackupRecoveryKey": {
        "additionalProperties": false,
        "properties": {
          "note": {
            "type": "string"
          },
          "password": {
            "type": "string"
          },
          "repository": {
            "description": "The restic repository URL or path as the agent uses it.",
            "type": "string"
          }
        },
        "required": [
          "repository",
          "password",
          "note"
        ],
        "type": "object"
      },
      "VolumeBackupView": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "bytesAdded": {
            "format": "int64",
            "type": "integer"
          },
          "consistency": {
            "description": "The mode the agent actually used (a stopped service is backed up without a freeze).",
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "destinationId": {
            "type": "string"
          },
          "destinationKind": {
            "type": "string"
          },
          "destinationName": {
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "files": {
            "format": "int64",
            "type": "integer"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "freezeMs": {
            "description": "How long the container was paused or stopped.",
            "format": "int64",
            "type": "integer"
          },
          "hookOutcome": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "locked": {
            "type": "boolean"
          },
          "mode": {
            "description": "The requested mode.",
            "type": "string"
          },
          "objectDeleted": {
            "description": "True once retention or a user removed the snapshot; the row stays as history.",
            "type": "boolean"
          },
          "restorable": {
            "type": "boolean"
          },
          "serverId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "sizeBytes": {
            "format": "int64",
            "type": "integer"
          },
          "snapshotId": {
            "type": "string"
          },
          "stageMethod": {
            "enum": [
              "reflink",
              "copy",
              "none"
            ],
            "type": "string"
          },
          "stageMs": {
            "description": "How long the local copy took.",
            "format": "int64",
            "type": "integer"
          },
          "startedAt": {
            "format": "date-time",
            "type": "string"
          },
          "status": {
            "enum": [
              "queued",
              "running",
              "succeeded",
              "failed",
              "skipped",
              "expired"
            ],
            "type": "string"
          },
          "trigger": {
            "enum": [
              "manual",
              "schedule",
              "pre_restore"
            ],
            "type": "string"
          },
          "volumes": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "warnings": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "id",
          "serviceId",
          "destinationId",
          "trigger",
          "status",
          "mode",
          "volumes",
          "sizeBytes",
          "bytesAdded",
          "files",
          "freezeMs",
          "stageMs",
          "warnings",
          "locked",
          "objectDeleted",
          "restorable",
          "createdAt"
        ],
        "type": "object"
      },
      "VolumeBackupVolumeRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "mountPath": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "mountPath"
        ],
        "type": "object"
      },
      "VolumeFileEntry": {
        "additionalProperties": false,
        "properties": {
          "mode": {
            "type": "string"
          },
          "modifiedAt": {
            "format": "date-time",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "size": {
            "format": "int64",
            "type": "integer"
          },
          "type": {
            "enum": [
              "file",
              "dir",
              "link",
              "other"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "type",
          "size"
        ],
        "type": "object"
      },
      "VolumeFileListing": {
        "additionalProperties": false,
        "properties": {
          "backupId": {
            "type": "string"
          },
          "entries": {
            "items": {
              "$ref": "#/components/schemas/VolumeFileEntry"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "path": {
            "type": "string"
          },
          "truncated": {
            "type": "boolean"
          },
          "volume": {
            "type": "string"
          }
        },
        "required": [
          "backupId",
          "volume",
          "path",
          "entries",
          "truncated"
        ],
        "type": "object"
      },
      "VolumeListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/VolumeView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "VolumeRef": {
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string"
          },
          "mountPath": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "mountPath"
        ],
        "type": "object"
      },
      "VolumeRestoreListOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/VolumeRestoreView"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      },
      "VolumeRestoreView": {
        "additionalProperties": false,
        "properties": {
          "actor": {
            "type": "string"
          },
          "backupId": {
            "type": "string"
          },
          "createdAt": {
            "format": "date-time",
            "type": "string"
          },
          "dockerName": {
            "type": "string"
          },
          "error": {
            "type": "string"
          },
          "finishedAt": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "mode": {
            "enum": [
              "new_volume",
              "in_place"
            ],
            "type": "string"
          },
          "preBackupId": {
            "type": "string"
          },
          "serviceId": {
            "type": "string"
          },
          "status": {
            "enum": [
              "pre_backup",
              "restoring",
              "succeeded",
              "failed"
            ],
            "type": "string"
          },
          "swapStaged": {
            "description": "A restore into a new volume succeeded and the swap is staged: apply it with Deploy.",
            "type": "boolean"
          },
          "volumeName": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "backupId",
          "serviceId",
          "volumeName",
          "mode",
          "status",
          "createdAt",
          "swapStaged"
        ],
        "type": "object"
      },
      "VolumeView": {
        "additionalProperties": false,
        "properties": {
          "dockerName": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "mountPath": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "restoreLabel": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "mountPath",
          "dockerName"
        ],
        "type": "object"
      },
      "WaitingFor": {
        "additionalProperties": false,
        "properties": {
          "offlineSince": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "serverId": {
            "type": "string"
          },
          "serverName": {
            "type": "string"
          }
        },
        "required": [
          "serverId",
          "serverName",
          "offlineSince"
        ],
        "type": "object"
      },
      "Warning": {
        "additionalProperties": false,
        "properties": {
          "code": {
            "enum": [
              "fallback",
              "emulation",
              "cold_cache"
            ],
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "type": "object"
      },
      "WebhookDeliveryView": {
        "additionalProperties": false,
        "properties": {
          "branch": {
            "type": "string"
          },
          "commitSha": {
            "type": "string"
          },
          "deliveryId": {
            "type": "string"
          },
          "deployments": {
            "description": "Deployments the delivery started",
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "event": {
            "type": "string"
          },
          "headers": {
            "additionalProperties": {
              "type": "string"
            },
            "description": "Request headers; signatures and tokens are redacted",
            "type": "object"
          },
          "httpStatus": {
            "format": "int64",
            "type": "integer"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "outcome": {
            "enum": [
              "processed",
              "ignored",
              "rejected",
              "replayed",
              "error"
            ],
            "type": "string"
          },
          "payloadBytes": {
            "format": "int64",
            "type": "integer"
          },
          "receivedAt": {
            "format": "date-time",
            "type": "string"
          },
          "repo": {
            "type": "string"
          },
          "summary": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "deliveryId",
          "event",
          "outcome",
          "httpStatus",
          "summary",
          "repo",
          "branch",
          "commitSha",
          "headers",
          "payloadBytes",
          "deployments",
          "receivedAt"
        ],
        "type": "object"
      },
      "WildcardCertView": {
        "additionalProperties": false,
        "properties": {
          "change": {
            "description": "Staged change awaiting Deploy proxy",
            "enum": [
              "none",
              "add",
              "update",
              "remove"
            ],
            "type": "string"
          },
          "checkedAt": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "coverGenerated": {
            "description": "Generated domains under the base domain use this certificate",
            "type": "boolean"
          },
          "daysToExpiry": {
            "format": "int64",
            "type": [
              "integer",
              "null"
            ]
          },
          "default": {
            "description": "The proxy's default certificate (defaultGeneratedCert)",
            "type": "boolean"
          },
          "domain": {
            "description": "Base domain: the certificate covers *.\u003cdomain\u003e",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "includeApex": {
            "type": "boolean"
          },
          "issuer": {
            "type": "string"
          },
          "names": {
            "items": {
              "type": "string"
            },
            "type": [
              "array",
              "null"
            ]
          },
          "notAfter": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "provider": {
            "description": "The lego provider code",
            "type": "string"
          },
          "status": {
            "enum": [
              "pending",
              "active",
              "error"
            ],
            "type": "string"
          },
          "statusMessage": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "domain",
          "names",
          "includeApex",
          "provider",
          "coverGenerated",
          "default",
          "status",
          "statusMessage",
          "issuer",
          "notAfter",
          "daysToExpiry",
          "checkedAt",
          "change"
        ],
        "type": "object"
      },
      "Zone": {
        "additionalProperties": false,
        "properties": {
          "accountId": {
            "type": "string"
          },
          "accountName": {
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "paused": {
            "type": "boolean"
          },
          "status": {
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "paused",
          "accountId",
          "accountName"
        ],
        "type": "object"
      },
      "ZonesOutputBody": {
        "additionalProperties": false,
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/Zone"
            },
            "type": [
              "array",
              "null"
            ]
          }
        },
        "required": [
          "items"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "bearer": {
        "description": "API token (`nct_…`)",
        "scheme": "bearer",
        "type": "http"
      },
      "cookie": {
        "description": "Browser session",
        "in": "cookie",
        "name": "nebulactrl_session",
        "type": "apiKey"
      }
    }
  },
  "info": {
    "description": "Control-plane API for NebulaCtrl, a self-hosted Docker-native PaaS. Authenticate with the `nebulactrl_session` cookie (browser) or `Authorization: Bearer nct_…` (API tokens). Errors are RFC 9457 problem+json with an additional `code` field.",
    "title": "NebulaCtrl API",
    "version": "0.1.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/analytics/traffic": {
      "get": {
        "description": "Workspace-wide report, optionally filtered by server, service or environment. Without a service or environment filter it needs `servers:read`; with one it needs `projects:read`. Project-restricted tokens only see their own services. Window to report. Minute data covers 24 hours; longer ranges read hourly (default 7 days kept) or daily (90 days) rows.",
        "operationId": "getTrafficAnalytics",
        "parameters": [
          {
            "description": "Window to report",
            "explode": false,
            "in": "query",
            "name": "range",
            "schema": {
              "default": "24h",
              "description": "Window to report",
              "enum": [
                "5m",
                "10m",
                "15m",
                "30m",
                "1h",
                "6h",
                "12h",
                "24h",
                "7d",
                "30d",
                "90d"
              ],
              "type": "string"
            }
          },
          {
            "description": "prev adds the previous equal window as comparison",
            "explode": false,
            "in": "query",
            "name": "compare",
            "schema": {
              "description": "prev adds the previous equal window as comparison",
              "enum": [
                "",
                "prev"
              ],
              "type": "string"
            }
          },
          {
            "description": "Restrict to one hostname",
            "explode": false,
            "in": "query",
            "name": "host",
            "schema": {
              "description": "Restrict to one hostname",
              "maxLength": 253,
              "type": "string"
            }
          },
          {
            "description": "true (default) ranks top paths by page views (documents); false ranks every request",
            "explode": false,
            "in": "query",
            "name": "pages",
            "schema": {
              "default": true,
              "description": "true (default) ranks top paths by page views (documents); false ranks every request",
              "type": "boolean"
            }
          },
          {
            "description": "Restrict to one server",
            "explode": false,
            "in": "query",
            "name": "serverId",
            "schema": {
              "description": "Restrict to one server",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Restrict to one service (needs projects:read)",
            "explode": false,
            "in": "query",
            "name": "serviceId",
            "schema": {
              "description": "Restrict to one service (needs projects:read)",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Restrict to the services of one environment (needs projects:read)",
            "explode": false,
            "in": "query",
            "name": "environmentId",
            "schema": {
              "description": "Restrict to the services of one environment (needs projects:read)",
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Report"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Traffic analytics across servers",
        "tags": [
          "analytics"
        ]
      }
    },
    "/approvals/{approvalId}": {
      "get": {
        "description": "The plan an AI client's production change needs a person to approve: what will happen, who asked (token and MCP client), when it expires and whether you can decide. Signed-in members who can read the project only; tokens are refused.",
        "operationId": "getApproval",
        "parameters": [
          {
            "in": "path",
            "name": "approvalId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApprovalView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a production approval request",
        "tags": [
          "approvals"
        ]
      }
    },
    "/approvals/{approvalId}/approve": {
      "post": {
        "description": "Lets the waiting call proceed once, with exactly the plan shown. Owner, Admin or Developer with deploy rights on the project, signed in. The approval is valid for ten minutes from the request and void when the service changes in the meantime.",
        "operationId": "approveApproval",
        "parameters": [
          {
            "in": "path",
            "name": "approvalId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApprovalView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Approve a production change",
        "tags": [
          "approvals"
        ]
      }
    },
    "/approvals/{approvalId}/decline": {
      "post": {
        "description": "Refuses the waiting call. The same call stays refused for one minute. Same permissions as approving.",
        "operationId": "declineApproval",
        "parameters": [
          {
            "in": "path",
            "name": "approvalId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApprovalView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Decline a production change",
        "tags": [
          "approvals"
        ]
      }
    },
    "/audit-events": {
      "get": {
        "description": "Requires the admin scope (browser sessions hold every scope). Filter by `projectId`, `resourceId` and `type` (an action prefix).",
        "operationId": "listAuditEvents",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Only events of this project",
            "explode": false,
            "in": "query",
            "name": "projectId",
            "schema": {
              "description": "Only events of this project",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Only events about this resource (service, deployment, …)",
            "explode": false,
            "in": "query",
            "name": "resourceId",
            "schema": {
              "description": "Only events about this resource (service, deployment, …)",
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "description": "Action prefix, e.g. deployment. or variable.set",
            "explode": false,
            "in": "query",
            "name": "type",
            "schema": {
              "description": "Action prefix, e.g. deployment. or variable.set",
              "maxLength": 100,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageAuditEvent"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List audit events, newest first",
        "tags": [
          "audit"
        ]
      }
    },
    "/auth-providers": {
      "get": {
        "operationId": "listAuthProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AdminProvidersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Configured single-sign-on providers (instance admin)",
        "tags": [
          "auth"
        ]
      },
      "post": {
        "description": "OIDC issuers are checked through discovery (`/.well-known/openid-configuration`) before saving.",
        "operationId": "createAuthProvider",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProviderInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderBody"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a single-sign-on provider (instance admin)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth-providers/{id}": {
      "delete": {
        "operationId": "deleteAuthProvider",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a single-sign-on provider and its linked identities (instance admin)",
        "tags": [
          "auth"
        ]
      },
      "put": {
        "operationId": "updateAuthProvider",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProviderInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Replace a single-sign-on provider's settings (instance admin)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth-settings": {
      "get": {
        "operationId": "getAuthSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuthSettingsBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Instance sign-in settings (instance admin)",
        "tags": [
          "auth"
        ]
      },
      "put": {
        "operationId": "updateAuthSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AuthSettingsBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuthSettingsBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Change instance sign-in settings (instance admin)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/2fa": {
      "get": {
        "operationId": "getSecondFactorMethods",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecondFactorMethodsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "What can finish the pending sign-in",
        "tags": [
          "auth"
        ]
      },
      "post": {
        "description": "Follows a login that answered 401 `two_factor_required` (or a provider login that redirected to `/login?step=2fa`). The pending login expires after 5 minutes and after 5 wrong codes; limited to 10 attempts per minute per client IP.",
        "operationId": "verifySecondFactor",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SecondFactorInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Finish sign-in with a TOTP or recovery code",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/2fa/passkey": {
      "post": {
        "description": "The pending login expires after 5 minutes and after 5 wrong answers; limited to 10 attempts per minute per client IP.",
        "operationId": "passkeySecondFactor",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "description": "The AuthenticationResponseJSON of the authenticator (PublicKeyCredential.toJSON())"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Finish sign-in with a passkey as the second factor",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/2fa/passkey/options": {
      "post": {
        "description": "Follows a login that answered 401 `two_factor_required`. Returns the WebAuthn request options for `navigator.credentials.get`; the answer goes to `POST /auth/2fa/passkey`.",
        "operationId": "passkeySecondFactorOptions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "description": "WebAuthn PublicKeyCredentialCreationOptions or PublicKeyCredentialRequestOptions wrapped as {publicKey: {...}}"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Ask the account's passkeys to finish a pending sign-in",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/login": {
      "post": {
        "description": "Limited to 10 attempts per minute per client IP.",
        "operationId": "login",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Sign in with email and password (sets the session cookie)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/logout": {
      "post": {
        "operationId": "logout",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Destroy the current session",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/oidc/{providerId}/callback": {
      "get": {
        "description": "Completes the sign-in and redirects to `/` (or `/login?step=2fa` / `/login?error=\u003ccode\u003e`).",
        "operationId": "providerLoginCallback",
        "parameters": [
          {
            "in": "path",
            "name": "providerId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "code",
            "schema": {
              "maxLength": 4096,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "state",
            "schema": {
              "maxLength": 512,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "error",
            "schema": {
              "maxLength": 200,
              "type": "string"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Found",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "Location": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "OAuth/OIDC redirect target of the identity provider",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/oidc/{providerId}/start": {
      "get": {
        "operationId": "startProviderLogin",
        "parameters": [
          {
            "in": "path",
            "name": "providerId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Team invite token that authorises sign-up of a new account",
            "explode": false,
            "in": "query",
            "name": "invite",
            "schema": {
              "description": "Team invite token that authorises sign-up of a new account",
              "maxLength": 200,
              "type": "string"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Found",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "Location": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Redirect to the identity provider",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/passkey/login": {
      "post": {
        "description": "A passkey verified on the authenticator (PIN or biometric) counts as two factors: the session is second-factor verified and no code is asked for.",
        "operationId": "passkeyLogin",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "description": "The AuthenticationResponseJSON of the authenticator (PublicKeyCredential.toJSON())"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Finish a passwordless sign-in with a passkey (sets the session cookie)",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/passkey/options": {
      "post": {
        "description": "Returns the WebAuthn request options for `navigator.credentials.get`; the answer goes to `POST /auth/passkey/login`. The options expire after 5 minutes. Limited to 10 attempts per minute per client IP.",
        "operationId": "passkeyLoginOptions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "description": "WebAuthn PublicKeyCredentialCreationOptions or PublicKeyCredentialRequestOptions wrapped as {publicKey: {...}}"
                }
              }
            },
            "description": "OK"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Start a passwordless sign-in with a passkey",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/password-reset": {
      "get": {
        "operationId": "getPasswordResetStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasswordResetStatusOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Whether password reset by email is available",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/password-reset/confirm": {
      "post": {
        "description": "Single use. Ends every session of the account; two-factor authentication still applies at the next sign-in. 400 `invalid_reset_token` for an unknown, expired or used link; limited to 10 attempts per minute per client IP.",
        "operationId": "confirmPasswordReset",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasswordResetConfirmInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Set a new password with a reset link",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/password-reset/request": {
      "post": {
        "description": "Answers 202 whether or not the account exists, so it cannot be used to find out which emails are registered; accounts that sign in only through an identity provider get no email. The link works once and expires after 30 minutes. Limited to 10 requests per hour per client IP and 3 per hour per email address. 503 `password_reset_unavailable` when the instance has no SMTP relay or team email channel, or no public URL.",
        "operationId": "requestPasswordReset",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasswordResetRequestInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasswordResetRequestOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {}
        ],
        "summary": "Email a password reset link",
        "tags": [
          "auth"
        ]
      }
    },
    "/auth/providers": {
      "get": {
        "operationId": "listLoginProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProvidersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Enabled single-sign-on providers for the login page",
        "tags": [
          "auth"
        ]
      }
    },
    "/backup-destinations": {
      "get": {
        "operationId": "listBackupDestinations",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DestinationListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List backup destinations",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "An S3-compatible bucket or a directory on the database's host (local; not off-site). Credentials are write-only. Requires the admin scope. Recommended S3 permissions: s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket, s3:AbortMultipartUpload on a bucket-scoped key.",
        "operationId": "createBackupDestination",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateDestinationInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DestinationView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a backup destination",
        "tags": [
          "backups"
        ]
      }
    },
    "/backup-destinations/{destinationId}": {
      "delete": {
        "description": "409 `destination_in_use` while a schedule or a stored backup uses it.",
        "operationId": "deleteBackupDestination",
        "parameters": [
          {
            "in": "path",
            "name": "destinationId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete a backup destination",
        "tags": [
          "backups"
        ]
      },
      "patch": {
        "operationId": "updateBackupDestination",
        "parameters": [
          {
            "in": "path",
            "name": "destinationId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchDestinationInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DestinationView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update a backup destination",
        "tags": [
          "backups"
        ]
      }
    },
    "/backup-destinations/{destinationId}/test": {
      "post": {
        "description": "The agent on the chosen server writes, reads back and deletes a probe object. Waits up to 25 seconds; if the agent has not answered by then the response carries no test result yet (poll the destination).",
        "operationId": "testBackupDestination",
        "parameters": [
          {
            "in": "path",
            "name": "destinationId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TestDestinationInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DestinationView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test a backup destination",
        "tags": [
          "backups"
        ]
      }
    },
    "/backup-restores/{restoreId}": {
      "get": {
        "operationId": "getBackupRestore",
        "parameters": [
          {
            "in": "path",
            "name": "restoreId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RestoreView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a restore",
        "tags": [
          "backups"
        ]
      }
    },
    "/backup-schedules/{scheduleId}": {
      "delete": {
        "operationId": "deleteBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "scheduleId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Delete a backup schedule",
        "tags": [
          "backups"
        ]
      },
      "patch": {
        "operationId": "updateBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "scheduleId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchScheduleInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ScheduleView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Update a backup schedule",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/{backupId}": {
      "delete": {
        "description": "Deletes the stored object through the agent. 409 when the backup is locked or its server is offline.",
        "operationId": "deleteBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Delete a backup",
        "tags": [
          "backups"
        ]
      },
      "get": {
        "operationId": "getBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a backup",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/{backupId}/lock": {
      "put": {
        "description": "Locked backups are never removed by retention or deleted.",
        "operationId": "lockBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LockInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Lock or unlock a backup",
        "tags": [
          "backups"
        ]
      }
    },
    "/backups/{backupId}/restore": {
      "post": {
        "description": "mode `new` (default) creates a sibling database, deploys it empty and restores into it; the original is untouched. mode `in_place` first takes a safety backup, then overwrites the database; it needs `confirmSlug`. Poll the restore.",
        "operationId": "restoreBackup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RestoreInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RestoreView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write",
              "projects:write"
            ]
          },
          {
            "cookie": [
              "deployments:write",
              "projects:write"
            ]
          }
        ],
        "summary": "Restore a backup",
        "tags": [
          "backups"
        ]
      }
    },
    "/catalog/templates": {
      "get": {
        "description": "Built-in, reviewed templates. `q` matches every word in the name, summary, tags, licence and database engines (best match first); `category` and `license` filter. Source-available templates carry `licenseClass: source-available`.",
        "operationId": "listCatalogTemplates",
        "parameters": [
          {
            "description": "Search terms (name, summary, tags)",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "Search terms (name, summary, tags)",
              "type": "string"
            }
          },
          {
            "description": "Restrict to a category",
            "explode": false,
            "in": "query",
            "name": "category",
            "schema": {
              "description": "Restrict to a category",
              "enum": [
                "homelab",
                "media",
                "storage",
                "games",
                "devtools",
                "ai",
                "data",
                "web",
                "analytics",
                "automation",
                "productivity",
                "security"
              ],
              "type": "string"
            }
          },
          {
            "description": "Restrict to a licence class: permissive, copyleft, source-available or proprietary",
            "explode": false,
            "in": "query",
            "name": "license",
            "schema": {
              "description": "Restrict to a licence class: permissive, copyleft, source-available or proprietary",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TemplateCatalog"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the one-click template catalog",
        "tags": [
          "templates"
        ]
      }
    },
    "/catalog/templates/{templateId}": {
      "get": {
        "operationId": "getCatalogTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "templateId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogTemplate"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a template",
        "tags": [
          "templates"
        ]
      }
    },
    "/certificates/{certificateId}": {
      "delete": {
        "description": "Refused with 409 `certificate_in_use` while a domain pins it.",
        "operationId": "deleteCertificate",
        "parameters": [
          {
            "in": "path",
            "name": "certificateId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Delete a certificate (staged removal when it is installed)",
        "tags": [
          "certificates"
        ]
      }
    },
    "/cloudflare/ips": {
      "get": {
        "description": "The list the origin lock allows: its source (built-in copy, Cloudflare API or the published text files), size, age and the state of the 3-hourly refresh. `stale` is set when fetching has failed for more than 24 hours; the last good list stays in use.",
        "operationId": "getCloudflareIPs",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IPListView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Cloudflare IP ranges in use",
        "tags": [
          "integrations"
        ]
      }
    },
    "/cloudflare/ips/refresh": {
      "post": {
        "description": "Fetches the list like the periodic job does (API first, text files second), validates it and stores it. A changed list is pushed to the servers with locked routes (a route update, no redeploy). 502 `ip_refresh_failed` when neither source works or the answer fails validation; the stored list stays.",
        "operationId": "refreshCloudflareIPs",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IPListView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Refresh Cloudflare's IP ranges now (team admin)",
        "tags": [
          "integrations"
        ]
      }
    },
    "/database-engines": {
      "get": {
        "operationId": "listDatabaseEngines",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the database engines and versions that can be created",
        "tags": [
          "databases"
        ]
      }
    },
    "/deployments/{deploymentId}": {
      "get": {
        "description": "`waitingFor` is set while the deployment waits for an offline server.",
        "operationId": "getDeployment",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeploymentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a deployment",
        "tags": [
          "deployments"
        ]
      }
    },
    "/deployments/{deploymentId}/cancel": {
      "post": {
        "description": "Before the agent acknowledged the deployment's command the deployment ends as `canceled` at once. Once the agent runs it, a cancel request is sent to the agent (`cancelRequestedAt` is set) and the deployment ends as `canceled` when the agent reports back, with the step it reached in `canceledAtStep`: a pull or build is stopped (a build's work directory is removed), containers of the new release are removed and the current release keeps serving, during verification the previous routes are restored first, and a recreate deploy that already stopped the previous release starts it again. If the previous release cannot be restored the result is `rollback_failed` with manual recovery steps. Once the new release is live it is too late: the deployment finishes (a still-running post-deploy command is stopped). An offline server receives the request when it reconnects. A finished deployment is 409 `cannot_cancel`.",
        "operationId": "cancelDeployment",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeploymentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Cancel a deployment at any step",
        "tags": [
          "deployments"
        ]
      }
    },
    "/deployments/{deploymentId}/commands": {
      "get": {
        "description": "Every command the control plane sent for the deployment (deploy, build_image, cancel_deploy, …): kind, server, delivery state, enqueue/ack/finish times, outcome and error, with the payload and result as persisted. Variable values, tokens, credentials and file contents never appear: those fields are masked. Needs the same access as the deployment's logs.",
        "operationId": "listDeploymentCommands",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CommandsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "A deployment's agent commands, redacted",
        "tags": [
          "deployments"
        ]
      }
    },
    "/deployments/{deploymentId}/events": {
      "get": {
        "operationId": "listDeploymentEvents",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "A deployment's step timeline",
        "tags": [
          "deployments"
        ]
      }
    },
    "/deployments/{deploymentId}/logs": {
      "get": {
        "description": "Without `follow` returns the persisted lines as `{items:[{id,stream,line,createdAt}]}` (at most 10,000 lines). With `follow=true` streams `data: {stream,line,ts}` until the deployment finishes, then `event: end`. The `debug` stream (the agent's verbose trace: docker calls, health probe attempts, route changes, timings; at most 500 lines) is left out unless `streams` asks for it.",
        "operationId": "getDeploymentLogs",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Stream lines as server-sent events until the deployment finishes",
            "explode": false,
            "in": "query",
            "name": "follow",
            "schema": {
              "description": "Stream lines as server-sent events until the deployment finishes",
              "type": "boolean"
            }
          },
          {
            "description": "Which streams to return: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug",
            "explode": false,
            "in": "query",
            "name": "streams",
            "schema": {
              "description": "Which streams to return: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug",
              "maxLength": 64,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              },
              "text/event-stream": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "JSON `{items}` without `follow`; a `text/event-stream` with `follow=true`"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Build and deploy logs of a deployment",
        "tags": [
          "logs"
        ]
      }
    },
    "/deployments/{deploymentId}/logs/download": {
      "get": {
        "description": "The persisted lines of the deployment (at most 10,000, plus 500 `debug` lines when asked for) as `format=txt` (default; `\u003ctime\u003e [\u003cstream\u003e] \u003cline\u003e`, runtime lines without the tag) or `format=ndjson` (`{ts, stream, line}` per line), in the order they were recorded, optionally limited to a `from`/`to` time range. Secret values are redacted. Audited as `deployment.logs.download`.",
        "operationId": "downloadDeploymentLogs",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "txt (default) or ndjson.",
            "explode": false,
            "in": "query",
            "name": "format",
            "schema": {
              "default": "txt",
              "description": "txt (default) or ndjson.",
              "enum": [
                "txt",
                "ndjson"
              ],
              "type": "string"
            }
          },
          {
            "description": "Which streams to include: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug",
            "explode": false,
            "in": "query",
            "name": "streams",
            "schema": {
              "description": "Which streams to include: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug",
              "maxLength": 64,
              "type": "string"
            }
          },
          {
            "description": "Only lines at or after this time (RFC 3339).",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Only lines at or after this time (RFC 3339).",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Only lines before this time (RFC 3339).",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Only lines before this time (RFC 3339).",
              "format": "date-time",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/x-ndjson": {
                "schema": {
                  "type": "string"
                }
              },
              "text/plain": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note."
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Download a deployment's build and deploy log as a file",
        "tags": [
          "logs"
        ]
      }
    },
    "/deployments/{deploymentId}/release": {
      "get": {
        "description": "The release id and generation, the resolved source (image ref and digest, or git commit), how it was built and where it ran, the configuration snapshot with secrets and file contents masked, and the keys of its variables with which are secret, references or provided by the platform. Never a variable value. 404 when the deployment has no release yet.",
        "operationId": "getDeploymentRelease",
        "parameters": [
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReleaseDetailView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "The release a deployment shipped, for debugging",
        "tags": [
          "deployments"
        ]
      }
    },
    "/deployments/{deploymentId}/rollback": {
      "post": {
        "description": "Application image and configuration only. Databases, volumes and external services are not rolled back. Creates a new deployment of the old release (`rolledBackFrom` is the deployment that was running). A git release whose built image was pruned returns 409 `image_pruned` with `commitSha` in the details: rebuild the commit instead.",
        "operationId": "rollbackDeployment",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deploymentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RollbackView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:rollback"
            ]
          },
          {
            "cookie": [
              "deployments:rollback"
            ]
          }
        ],
        "summary": "Roll back to the release of a successful deployment",
        "tags": [
          "deployments"
        ]
      }
    },
    "/dns/credentials": {
      "get": {
        "description": "Needs `proxy:write`. Secret variables are never returned; non-secret ones (an access key ID, a region) only to administrators.",
        "operationId": "listDnsCredentials",
        "parameters": [
          {
            "description": "Only the team-wide credentials and this server's",
            "explode": false,
            "in": "query",
            "name": "serverId",
            "schema": {
              "description": "Only the team-wide credentials and this server's",
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "List DNS provider credentials",
        "tags": [
          "dns01"
        ]
      },
      "post": {
        "description": "Needs `admin`. The values are sealed with the instance secret key and delivered to the proxy container as environment variables at deploy time; they are never part of a stored payload and never returned. 422 `invalid_credential` / `invalid_provider`, 409 `credential_name_taken`.",
        "operationId": "createDnsCredential",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateCredentialInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DNSCredential"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a DNS provider credential",
        "tags": [
          "dns01"
        ]
      }
    },
    "/dns/credentials/{credentialId}": {
      "delete": {
        "description": "Needs `admin`. 409 `credential_in_use` while a resolver (desired or applied) uses it.",
        "operationId": "deleteDnsCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credentialId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete a credential",
        "tags": [
          "dns01"
        ]
      },
      "patch": {
        "description": "Needs `admin`. Changed values stage a proxy deploy on every server whose resolver uses the credential (the proxy container is recreated with the new environment).",
        "operationId": "updateDnsCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credentialId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateCredentialInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DNSCredential"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Rename a credential or rotate its values",
        "tags": [
          "dns01"
        ]
      }
    },
    "/dns/lego-providers": {
      "get": {
        "description": "The providers of the lego release Traefik vendors that have no curated form: code, name, the lego docs link and the variables lego reads for it. A credential for one of them is a provider code plus variables from this list. `exec` and `manual` are not offered. Variables that read a file are left out.",
        "operationId": "listLegoDnsProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProvidersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Every other lego DNS provider, for the generic form",
        "tags": [
          "dns01"
        ]
      }
    },
    "/dns/providers": {
      "get": {
        "description": "Cloudflare, Amazon Route 53, Hetzner, DigitalOcean, Gandi, OVHcloud, Porkbun, Namecheap, Google Cloud DNS, Azure DNS, deSEC, Linode, Vultr, Scaleway, Bunny, DNSimple, IONOS, GoDaddy and Netcup. The variable names are the ones Traefik's ACME client (lego v5) reads. Any other lego provider is in GET /dns/lego-providers.",
        "operationId": "listDnsProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProvidersOutputBody1"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Curated DNS-01 providers and their credential variables",
        "tags": [
          "dns01"
        ]
      }
    },
    "/dns01/wildcards/{wildcardId}": {
      "delete": {
        "operationId": "deleteWildcardCert",
        "parameters": [
          {
            "in": "path",
            "name": "wildcardId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage the removal of a wildcard certificate",
        "tags": [
          "dns01"
        ]
      },
      "patch": {
        "operationId": "updateWildcardCert",
        "parameters": [
          {
            "in": "path",
            "name": "wildcardId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateWildcardInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage a change of a wildcard certificate's options",
        "tags": [
          "dns01"
        ]
      }
    },
    "/domains/{domainId}": {
      "delete": {
        "operationId": "deleteDomain",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Remove a domain (staged until deployed)",
        "tags": [
          "domains"
        ]
      },
      "patch": {
        "description": "Requires `If-Match: \"\u003cgeneration\u003e\"` of the owning service; a stale value returns 412 `generation_conflict`. Hostname changes need `projects:write`; every other field (path prefix, strip/add prefix, redirect, TLS mode, pinned certificate, options) also needs `proxy:write` and an agent with proxy v2 (422 `agent_too_old`). 422 codes: `invalid_path_prefix`, `invalid_redirect`, `redirect_loop`, `invalid_tls_mode`, `certificate_mismatch`, `invalid_options`, `basic_auth_needs_users`. 409 `domain_conflict` when host+path is taken.",
        "operationId": "updateDomain",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The owning service's ETag (generation) from its last GET. Required.",
            "in": "header",
            "name": "If-Match",
            "schema": {
              "description": "The owning service's ETag (generation) from its last GET. Required.",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DomainView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "description": "The owning service's generation after the change",
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Failed"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "428": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Required"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update a domain's routing rule (staged until deployed)",
        "tags": [
          "domains"
        ]
      }
    },
    "/domains/{domainId}/auth-users": {
      "put": {
        "description": "Replaces the whole user set (needs `proxy:write`). A user that already exists may omit the password to keep it. Passwords are bcrypt-hashed (cost 10) and stored sealed; only user names are ever returned. Enable the option with `PATCH /domains/{id}` `options.basicAuth`. Users apply live with the next route push.",
        "operationId": "setDomainAuthUsers",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "items": {
                  "$ref": "#/components/schemas/AuthUserBody"
                },
                "type": [
                  "array",
                  "null"
                ]
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuthUsersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Replace a domain's basic-auth users",
        "tags": [
          "domains"
        ]
      }
    },
    "/domains/{domainId}/auth-users/{username}": {
      "delete": {
        "operationId": "deleteDomainAuthUser",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "username",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Remove one basic-auth user",
        "tags": [
          "domains"
        ]
      }
    },
    "/domains/{domainId}/dns": {
      "get": {
        "description": "Reads the records of the hostname from Cloudflare and classifies them: `managed` (a record NebulaCtrl created points to the server or tunnel), `present` (a record NebulaCtrl did not create already points there), `wrong_target`, `missing` or `not_in_zone`. Changes nothing.",
        "operationId": "getDomainDns",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DNSStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Live Cloudflare DNS status of a domain",
        "tags": [
          "domains"
        ]
      },
      "put": {
        "description": "Sets the per-domain proxy toggle and whether NebulaCtrl manages the domain's records, then syncs. A failed sync is reported as `error` in the status and retried in the background.",
        "operationId": "updateDomainDns",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DnsSettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DNSStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Change a domain's Cloudflare settings",
        "tags": [
          "domains"
        ]
      }
    },
    "/domains/{domainId}/dns/fix": {
      "post": {
        "description": "Creates or corrects the record so the hostname points at the server (or tunnel). A record NebulaCtrl did not create is never modified unless `adopt` is true (409 `adoption_required`; 409 `dns_conflict` when adopting is impossible, for example a CNAME next to an A record). 422 `not_configured` / `not_in_zone`; 502 when Cloudflare fails.",
        "operationId": "fixDomainDns",
        "parameters": [
          {
            "in": "path",
            "name": "domainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DnsFixInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DNSStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Fix a domain's DNS record",
        "tags": [
          "domains"
        ]
      }
    },
    "/dump-restores/{restoreId}": {
      "get": {
        "operationId": "getDumpRestore",
        "parameters": [
          {
            "in": "path",
            "name": "restoreId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DumpRestoreView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a restore from a dump file",
        "tags": [
          "backups"
        ]
      }
    },
    "/dump-restores/{restoreId}/cancel": {
      "post": {
        "description": "Only while the restore is provisioning, taking its safety backup or awaiting its file. The new database it created stays; delete it like any service.",
        "operationId": "cancelDumpRestore",
        "parameters": [
          {
            "in": "path",
            "name": "restoreId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DumpRestoreView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Cancel a restore that has not received its file",
        "tags": [
          "backups"
        ]
      }
    },
    "/environments/{environmentId}": {
      "delete": {
        "description": "Fails with 409 `environment_not_empty` while the environment still has services.",
        "operationId": "deleteEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete an empty environment",
        "tags": [
          "environments"
        ]
      },
      "patch": {
        "operationId": "updateEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateEnvironmentInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Environment"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update an environment",
        "tags": [
          "environments"
        ]
      }
    },
    "/environments/{environmentId}/clone": {
      "post": {
        "description": "Creates a new, non-production environment in the same project with a staged copy of every service of the source: configuration, variables, the environment's shared variables, volume definitions, links, repository links and canvas layout. Slugs are kept, so references such as `${{postgres.DATABASE_URL}}` point at the cloned siblings. Secrets are copied sealed and generated values are generated again. Databases are created new and empty: restore a dump into them. Volumes are new and empty. Domains are dropped (default) or cloned with a suffix; 409 `domain_conflict` when a suffixed hostname is taken. Route services and Compose stacks are skipped and listed. Nothing runs until the services are deployed. `dryRun` returns the plan and changes nothing.",
        "operationId": "cloneEnvironment",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CloneEnvironmentInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CloneResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Clone an environment",
        "tags": [
          "environments"
        ]
      }
    },
    "/environments/{environmentId}/compose-imports": {
      "post": {
        "description": "Creates the services of a Compose project as staged changes: services, volumes, config files, variables, domains, published ports, links (deploy order) and a canvas group. The request must match a plan without blockers. With `deploy: true` the new services are deployed in dependency order (needs `deployments:write`); otherwise review them and deploy from the staged bar.",
        "operationId": "importCompose",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ComposeImportRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ComposeImportResult"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Import a Docker Compose project",
        "tags": [
          "compose"
        ]
      }
    },
    "/environments/{environmentId}/compose-imports/plan": {
      "post": {
        "description": "Reads a docker-compose.yml (pasted, or from a git repository) and returns, for every Compose service, how it would be imported: source, ports and domains, variables (secrets are flagged and never returned), volumes, files, the rewritten references, what is not supported, and whether an official database image can become a managed database. `choices` change the defaults (include a service, switch to a managed database, publish a port, ...); send the same body again to see the effect. Nothing is written. Reading from a git repository needs `projects:write`.",
        "operationId": "planComposeImport",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ComposePlanRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ComposePlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Review a Docker Compose import",
        "tags": [
          "compose"
        ]
      }
    },
    "/environments/{environmentId}/databases": {
      "post": {
        "description": "Creates a staged database service with its data volume and generated credentials; nothing runs until it is deployed. Other services connect with `${{\u003cslug\u003e.DATABASE_URL}}` (or `REDIS_URL`, `MONGO_URL`).",
        "operationId": "createDatabase",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateDatabaseInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Create a managed database",
        "tags": [
          "databases"
        ]
      }
    },
    "/environments/{environmentId}/deploy-staged": {
      "post": {
        "description": "Services start in reference order: providers of `${{service.KEY}}` references first (otherwise databases first; a reference cycle keeps the input order). A consumer's deployment waits until the providers of the same batch finished (at most 10 minutes). `order` lists the service ids in the order they were started. Services that cannot deploy are skipped unless named in `serviceIds`.",
        "operationId": "deployStaged",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeployStagedInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StagedResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Deploy every service with staged changes",
        "tags": [
          "deployments"
        ]
      }
    },
    "/environments/{environmentId}/deployments": {
      "get": {
        "description": "Filter by `status` (comma-separated) and `serviceId`.",
        "operationId": "listEnvironmentDeployments",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Comma-separated statuses, e.g. failed,succeeded",
            "explode": false,
            "in": "query",
            "name": "status",
            "schema": {
              "description": "Comma-separated statuses, e.g. failed,succeeded",
              "maxLength": 200,
              "type": "string"
            }
          },
          {
            "description": "Only deployments of this service",
            "explode": false,
            "in": "query",
            "name": "serviceId",
            "schema": {
              "description": "Only deployments of this service",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageEnvDeploymentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the deployments of every service of an environment (newest first)",
        "tags": [
          "deployments"
        ]
      }
    },
    "/environments/{environmentId}/deployments/daily": {
      "get": {
        "description": "One entry per day, oldest first, ending today (`days` 1..90, default 30); days without deployments are zeros. `failed` counts failed and rollback_failed, `other` counts canceled, rolled_back and in-flight deployments.",
        "operationId": "getEnvironmentDeploymentsDaily",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Window length in UTC days, ending today",
            "explode": false,
            "in": "query",
            "name": "days",
            "schema": {
              "default": 30,
              "description": "Window length in UTC days, ending today",
              "format": "int64",
              "maximum": 90,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DailyOutcomes"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Deployment outcomes per UTC day for an environment",
        "tags": [
          "deployments"
        ]
      }
    },
    "/environments/{environmentId}/env-template-preview": {
      "post": {
        "description": "Like the service scan, for a repository that has no service yet: nothing is created or stored. The suggestions can reference the databases of the environment. Give a git connection and repository, or a repository URL (with `gitToken` for a private one); `serverId` is the server a read that needs an agent (Bitbucket, other hosts, a pasted token) runs on. The pasted token is used for this read only and never stored. A repository that cannot be read answers `status: unavailable` with the reason.",
        "operationId": "previewEnvTemplates",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/EnvTemplatePreviewInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnvTemplateScan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Preview the .env.example keys of a repository before creating its service",
        "tags": [
          "variables"
        ]
      }
    },
    "/environments/{environmentId}/link-proposals": {
      "get": {
        "description": "Writes nothing. Returns every reference the consumer (`from`) could hold to reach the provider (`to`), the recommended set flagged and each row's status on the consumer, plus warnings and whether an edge already exists. Add the chosen ones with PUT /services/{id}/variables; the edge is drawn from those references.",
        "operationId": "previewLink",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The consumer: the service that would hold the variables",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "The consumer: the service that would hold the variables",
              "type": "string"
            }
          },
          {
            "description": "The provider: the service the variables point at",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "The provider: the service the variables point at",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LinkPreview"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Preview the variables linking two services would propose",
        "tags": [
          "links"
        ]
      }
    },
    "/environments/{environmentId}/links": {
      "get": {
        "operationId": "listLinks",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LinkListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the links between services of an environment",
        "tags": [
          "links"
        ]
      },
      "post": {
        "description": "A link is presentation plus review only. The response proposes variables for the source service; they are NOT added. Add them with PUT /services/{id}/variables after the user confirms. When the two services run on different servers the link also opens a mesh grant (cross-server service link): the response's mesh block lists the links and devices; devices need acceptMeshChanges.",
        "operationId": "createLink",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateLinkInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LinkResult"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Link two services",
        "tags": [
          "links"
        ]
      }
    },
    "/environments/{environmentId}/logs": {
      "get": {
        "description": "Same shape as the service log endpoint; entries also carry `serviceId` and `serviceName`.",
        "operationId": "getEnvironmentLogs",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "tail",
            "schema": {
              "default": 100,
              "format": "int64",
              "maximum": 5000,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "description": "Stream new lines as server-sent events",
            "explode": false,
            "in": "query",
            "name": "follow",
            "schema": {
              "description": "Stream new lines as server-sent events",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              },
              "text/event-stream": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "JSON `{items}` without `follow`; a `text/event-stream` with `follow=true`"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Merged runtime logs of every service of an environment",
        "tags": [
          "logs"
        ]
      }
    },
    "/environments/{environmentId}/logs/history": {
      "get": {
        "description": "The same as the service endpoint for every service of the environment, merged by time. Entries carry `serviceId` and `serviceName`. Services whose server is offline are listed in `unavailable` instead of failing the request.",
        "operationId": "getEnvironmentLogHistory",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Only lines before this time (RFC 3339). Default: now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Only lines before this time (RFC 3339). Default: now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "A log search query (the same language as the log views): free text, \"phrases\", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "A log search query (the same language as the log views): free text, \"phrases\", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 500, max 2000).",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "description": "Page size (default 500, max 2000).",
              "format": "int64",
              "maximum": 2000,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor.",
              "type": "string"
            }
          },
          {
            "description": "desc (default): newest first. asc: oldest first.",
            "explode": false,
            "in": "query",
            "name": "order",
            "schema": {
              "description": "desc (default): newest first. asc: oldest first.",
              "enum": [
                "desc",
                "asc"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogHistoryPage"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Stored runtime logs of an environment",
        "tags": [
          "logs"
        ]
      }
    },
    "/environments/{environmentId}/mesh": {
      "get": {
        "description": "Needs `projects:read`. Links are the tailnet link nodes of the environment (service and replication purpose); grants say which service reaches which provider and why (`reference`, `edge`, `replica`); routes list, per consumer, the providers on other servers with the mesh port the consumer dials.",
        "operationId": "getEnvironmentMesh",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnvironmentMeshView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Mesh links, grants and routes of an environment",
        "tags": [
          "mesh"
        ]
      }
    },
    "/environments/{environmentId}/mesh/reconcile": {
      "post": {
        "description": "Needs `servers:write`. Mode `add` creates every link, exposure and grant the environment's references and canvas edges need; it adds tailnet devices, so it needs `acceptMeshChanges` (409 `mesh_confirmation_required` states the count; 422 with the blocker code, for example `mesh_server_required`, when the mesh cannot serve a need). Mode `repair` is what runs every 5 minutes: it only removes grants whose source is gone (10 minutes grace; an edge's grant at once) and never adds a device.",
        "operationId": "reconcileEnvironmentMesh",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReconcileInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReconcileView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Reconcile the mesh links of an environment now",
        "tags": [
          "mesh"
        ]
      }
    },
    "/environments/{environmentId}/routes": {
      "post": {
        "description": "A route service has no container: it publishes an external upstream (http), or exposes a tcp/udp port of a server (optionally for a managed service). Needs `projects:write` and `proxy:write`. The server is required. 422 codes: `invalid_config`, `invalid_listen_port`, `upstream_denied` (the server's upstream policy), `invalid_upstream`, `agent_too_old`. 409 `port_in_use` when another route holds the listen port, `domain_conflict` for a taken hostname.",
        "operationId": "createRoute",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateRouteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Create a route service (staged until deployed)",
        "tags": [
          "routes"
        ]
      }
    },
    "/environments/{environmentId}/services": {
      "get": {
        "operationId": "listServices",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageServiceView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List an environment's services",
        "tags": [
          "services"
        ]
      },
      "post": {
        "description": "Creating a service stages its configuration; nothing runs until it is deployed. Managed databases are created with `POST /environments/{environmentId}/databases`. A Compose stack is `kind: stack`, `sourceType: compose` with `config.stack.compose`; the server derives `config.stack.components`. 422 `invalid_compose` (details.violations) when the compose file does not parse, uses something stacks do not support, or breaks the safe allow-list while the service's server does not have Unrestricted Compose.",
        "operationId": "createService",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "Created",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Create a service",
        "tags": [
          "services"
        ]
      }
    },
    "/environments/{environmentId}/shared-variables": {
      "get": {
        "description": "Shared variables reach a service only through an explicit `KEY=${{shared.KEY}}` variable (see share). An environment value overrides the project value for that environment. Shared values may only reference other shared variables, team variables, external secrets, generators and transforms.",
        "operationId": "listEnvironmentSharedVariables",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List an environment's shared variables (own values plus inherited project values)",
        "tags": [
          "shared-variables"
        ]
      },
      "put": {
        "operationId": "putEnvironmentSharedVariables",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SharedVariablesPutBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Upsert environment shared variables (restages consumers)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/environments/{environmentId}/shared-variables/{key}": {
      "delete": {
        "operationId": "deleteEnvironmentSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete an environment shared variable (falls back to the project value)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/environments/{environmentId}/shared-variables/{key}/history": {
      "get": {
        "operationId": "getEnvironmentSharedVariableHistory",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HistoryOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Version history of an environment shared variable",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/environments/{environmentId}/shared-variables/{key}/rotate": {
      "post": {
        "operationId": "rotateEnvironmentSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VariableRotateBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableRotationPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Rotate a generated environment shared variable (plan or stage)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/environments/{environmentId}/shared-variables/{key}/share": {
      "post": {
        "operationId": "shareEnvironmentSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ShareSharedInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Stage KEY=${{shared.KEY}} on services",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/environments/{environmentId}/stacks/check": {
      "post": {
        "description": "Parses the compose file, lists its components and applies the Compose allow-list for the given server. Nothing is stored. Violations of kind `unsupported` always block a stack; `restricted` ones only on a server without Unrestricted. A file that is not valid YAML or not a compose file is a 422 `invalid_compose`.",
        "operationId": "checkStack",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckStackInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StackCheck"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Check a compose file for running as a stack",
        "tags": [
          "stacks"
        ]
      }
    },
    "/environments/{environmentId}/template-instances": {
      "get": {
        "operationId": "listTemplateInstances",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/TemplateInstance"
                  },
                  "type": [
                    "array",
                    "null"
                  ]
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the template stacks installed in an environment",
        "tags": [
          "templates"
        ]
      }
    },
    "/environments/{environmentId}/templates/{templateId}/instances": {
      "post": {
        "description": "Creates the template's services, volumes, files, variables (secrets generated once), domain, published ports, links and a canvas group as staged changes. With `deploy: true` the new services are deployed in dependency order (needs `deployments:write`); templates that publish TCP/UDP ports also need `proxy:write`.",
        "operationId": "installTemplate",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "templateId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TemplateInstallRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TemplateInstallResult"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Install a template",
        "tags": [
          "templates"
        ]
      }
    },
    "/environments/{environmentId}/templates/{templateId}/plan": {
      "post": {
        "description": "Returns the services that would be created, the secrets that would be generated (names only) and checks against the chosen server (architecture, memory, proxy, domain, published ports). Nothing is written.",
        "operationId": "planTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "templateId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TemplatePlanRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TemplatePlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Preflight a template install",
        "tags": [
          "templates"
        ]
      }
    },
    "/environments/{environmentId}/variable-usage": {
      "get": {
        "operationId": "getVariableUsage",
        "parameters": [
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Namespace: shared (default), team or a service slug",
            "explode": false,
            "in": "query",
            "name": "ns",
            "schema": {
              "description": "Namespace: shared (default), team or a service slug",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UsageOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Which variables reference a variable",
        "tags": [
          "variables"
        ]
      }
    },
    "/events": {
      "get": {
        "description": "Each message is `data: {\"type\",\"projectId\",\"environmentId\",\"resourceId\"}`. A comment line is sent every 15 seconds as a heartbeat. Clients refetch the named resources.",
        "operationId": "streamEvents",
        "responses": {
          "200": {
            "content": {
              "text/event-stream": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "Event stream"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Server-sent invalidation feed",
        "tags": [
          "events"
        ]
      }
    },
    "/fleet": {
      "get": {
        "description": "Per server: resource usage, the memory promised through service limits (committed), whether that exceeds the host, and the services placed on it (limited to the caller's projects).",
        "operationId": "getFleet",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Overview"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Capacity and placement of every server",
        "tags": [
          "fleet"
        ]
      }
    },
    "/geo/maxmind": {
      "delete": {
        "description": "Refused with 409 `maxmind_in_use` while a server still uses the MaxMind source.",
        "operationId": "deleteMaxMindCredentials",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GeoCredentialsStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Remove the team's MaxMind account",
        "tags": [
          "servers"
        ]
      },
      "get": {
        "description": "The licence key is write-only. `serversUsing` counts the team's servers that currently use the MaxMind source.",
        "operationId": "getMaxMindCredentials",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GeoCredentialsStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Whether the team has a MaxMind GeoLite2 account on file",
        "tags": [
          "servers"
        ]
      },
      "put": {
        "description": "The key is sealed with the instance secret key. Servers on the MaxMind source receive it with their next reconcile (sent immediately to online agents, never persisted in a command).",
        "operationId": "setMaxMindCredentials",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetGeoCredentialsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GeoCredentialsStatus"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Store the team's MaxMind account ID and licence key",
        "tags": [
          "servers"
        ]
      }
    },
    "/git/connections": {
      "get": {
        "description": "Connections to GitHub, GitLab, Gitea, Forgejo and Bitbucket. Credentials and secrets are never returned.",
        "operationId": "listGitConnections",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListConnectionsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List git connections",
        "tags": [
          "git"
        ]
      },
      "post": {
        "description": "Token connections are verified against the provider first (422 `credentials_invalid`). OAuth connections start `pending` and return an `authorizeUrl` to open in the browser; register `oauth.redirectUri` as the OAuth application's redirect URI. The response carries the webhook secret once; GitLab, Gitea and Forgejo webhooks are registered automatically when a service is linked, a Bitbucket webhook is created by hand (URL `webhookUrl`, this secret). Requires the `admin` scope.",
        "operationId": "createGitConnection",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateConnectionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreateConnectionResult"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Connect GitLab, Gitea, Forgejo or Bitbucket",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}": {
      "delete": {
        "description": "Refused with 409 `connection_in_use` while services use it, unless `force` is set (it unlinks them). Webhooks NebulaCtrl registered are removed; a GitHub App stays installed at GitHub. Requires the `admin` scope.",
        "operationId": "deleteGitConnection",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Also unlink the services that use the connection",
            "explode": false,
            "in": "query",
            "name": "force",
            "schema": {
              "description": "Also unlink the services that use the connection",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a git connection",
        "tags": [
          "git"
        ]
      },
      "get": {
        "operationId": "getGitConnection",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a git connection",
        "tags": [
          "git"
        ]
      },
      "patch": {
        "description": "Requires the `admin` scope. Secrets are write-only.",
        "operationId": "updateGitConnection",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateConnectionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Rename a git connection or replace its credentials",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/branches": {
      "get": {
        "operationId": "listGitBranches",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "owner/name",
            "explode": false,
            "in": "query",
            "name": "repo",
            "required": true,
            "schema": {
              "description": "owner/name",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BranchesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "List a repository's branches",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/deliveries": {
      "get": {
        "description": "The last 200 deliveries (14 days), newest first: event, outcome (processed, ignored, rejected, replayed, error), what they started. Headers are redacted. Requires the `admin` scope.",
        "operationId": "listGitDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageWebhookDeliveryView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Webhook delivery log of a connection",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/oauth/start": {
      "post": {
        "description": "Returns the provider URL to open in the browser.",
        "operationId": "startGitConnectionOAuth",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuthorizeOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Start (or restart) the OAuth authorization of a connection",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/refresh": {
      "post": {
        "description": "For an App installed without returning to NebulaCtrl: finds the installation through the GitHub API and verifies the connection.",
        "operationId": "refreshGitHubInstallation",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Look up a GitHub App's installation again",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/repos": {
      "get": {
        "description": "The repository picker. 422 `no_repo_api` for Bitbucket (enter owner/name instead). Requires `projects:write`.",
        "operationId": "listGitRepos",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Filter by name",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "Filter by name",
              "maxLength": 100,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 100,
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReposOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "List the repositories a connection can access",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/test": {
      "post": {
        "description": "Calls the provider with the stored credentials and records the outcome in `status`.",
        "operationId": "testGitConnection",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test a git connection",
        "tags": [
          "git"
        ]
      }
    },
    "/git/connections/{connectionId}/webhook-secret/rotate": {
      "post": {
        "description": "Only for providers whose webhook is created by hand (Bitbucket). The new secret is returned once; update the webhook at the provider.",
        "operationId": "rotateGitWebhookSecret",
        "parameters": [
          {
            "in": "path",
            "name": "connectionId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Issue a new webhook secret (Bitbucket)",
        "tags": [
          "git"
        ]
      }
    },
    "/git/github/manifest": {
      "post": {
        "description": "Creates a pending GitHub connection and returns a manifest: submit it as the form field `manifest` with a POST to `postUrl` (the browser does this; GitHub asks the user to confirm). GitHub then redirects back to NebulaCtrl, which stores the App and sends the user to install it. The App gets read access to code and metadata and write access to pull requests and commit statuses, and subscribes to push and pull_request events. Needs NEBULACTRL_PUBLIC_URL (422 `public_url_required`). Requires the `admin` scope.",
        "operationId": "startGitHubAppManifest",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManifestInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManifestStart"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Start creating a GitHub App",
        "tags": [
          "git"
        ]
      }
    },
    "/imports/coolify/apply": {
      "post": {
        "description": "Creates the projects, environments, services and managed databases of a Coolify instance as staged changes: services, volumes, variables (secrets marked), domains and links. The request must match a plan without blockers; the plan is recomputed from Coolify, so the response never depends on a stale review. Database and volume data is not copied. With `deploy: true` the new services are deployed (needs deployments:write); otherwise review them and deploy from the staged bar.",
        "operationId": "importCoolify",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CoolifyApplyRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CoolifyApplyResult"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Import from Coolify",
        "tags": [
          "imports"
        ]
      }
    },
    "/imports/coolify/plan": {
      "post": {
        "description": "Reads a Coolify v4 instance with the given API token (read and read:sensitive) and returns how every project, environment, application and database would be imported: the service source and settings, domains, variables by key (secrets flagged, values never returned), references rewritten to other imported resources, what is not supported, and the follow-up steps (data is never copied). `choices` change the defaults; send the same body again to see the effect. Nothing is written and the Coolify token is used for this request only. Needs projects:write and an unrestricted token, because the server connects to the given address with the credential.",
        "operationId": "planCoolifyImport",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CoolifyPlanRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CoolifyPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Review an import from Coolify",
        "tags": [
          "imports"
        ]
      }
    },
    "/instance": {
      "get": {
        "description": "Whether team creation is allowed; SMTP details only for the instance admin (the first user).",
        "operationId": "getInstance",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Instance settings",
        "tags": [
          "teams"
        ]
      },
      "patch": {
        "description": "Instance admin only: allow team creation and the SMTP relay used to mail invites when a team has no email channel.",
        "operationId": "updateInstance",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateInstanceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Change the instance settings",
        "tags": [
          "teams"
        ]
      }
    },
    "/instance/backup": {
      "get": {
        "description": "A scheduled pg_dump of NebulaCtrl's own database to one instance-wide destination. The instance secret key is never part of a backup. Instance admin only.",
        "operationId": "getInstanceBackup",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get the control-plane backup settings",
        "tags": [
          "instance"
        ]
      },
      "patch": {
        "description": "Credentials are write-only. Enabling needs a complete destination. Instance admin only.",
        "operationId": "updateInstanceBackup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchInstanceBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update the control-plane backup settings",
        "tags": [
          "instance"
        ]
      }
    },
    "/instance/backup/key-acknowledgement": {
      "post": {
        "description": "Dismisses the reminder card. Backups do not contain NEBULACTRL_SECRET_KEY, and a restore is useless without it: store it in a password manager or vault, apart from the backups.",
        "operationId": "acknowledgeInstanceBackupKey",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Confirm the instance secret key is stored separately",
        "tags": [
          "instance"
        ]
      }
    },
    "/instance/backup/runs": {
      "get": {
        "operationId": "listInstanceBackupRuns",
        "parameters": [
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 0,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceRunListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List control-plane backup runs",
        "tags": [
          "instance"
        ]
      },
      "post": {
        "description": "Returns 202 with the running backup; poll the runs or listen for `instance.backup.updated` events. 409 `backup_in_progress` while one is running.",
        "operationId": "runInstanceBackup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceRunView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Back up the control plane now",
        "tags": [
          "instance"
        ]
      }
    },
    "/instance/backup/test": {
      "post": {
        "description": "The control plane writes, reads back and deletes a probe object. The verdict is stored on the settings.",
        "operationId": "testInstanceBackup",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test the control-plane backup destination",
        "tags": [
          "instance"
        ]
      }
    },
    "/instance/dashboard-access": {
      "get": {
        "description": "Who may reach the dashboard's hostname (an IP allow list on its system route) and how its certificate is issued (automatic HTTP-01 or a DNS-01 resolver of the control-plane server). `clientIp` is the caller's address as the allow list sees it. Instance admin only.",
        "operationId": "getDashboardAccess",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DashboardAccessView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get the dashboard access settings",
        "tags": [
          "instance"
        ]
      },
      "put": {
        "description": "Replaces the allow list and the certificate method and re-sends the control-plane server's routes: an allow list applies immediately. Agents on other servers and webhooks reach the control plane through the same hostname, so keep their addresses in the list. 409 `dashboard_lockout` when a non-empty list excludes the caller's current address, unless `confirmLockout` is true. 422 `resolver_not_configured` when the control-plane server has no resolver of that provider. A resolver that is staged but not applied yet sets `proxyDeployRequired`: the dashboard keeps its HTTP-01 certificate until Deploy proxy. 409 `dashboard_route_disabled` when the dashboard has no system route. Instance admin only.",
        "operationId": "updateDashboardAccess",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateDashboardAccessInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DashboardAccessView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update the dashboard access settings",
        "tags": [
          "instance"
        ]
      }
    },
    "/instance/docker-options": {
      "get": {
        "description": "What the Docker options accept: capability lists, the curated sysctls, reserved label prefixes, stop signals and which options work only on an unrestricted server.",
        "operationId": "getDockerOptionsPolicy",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DockerOptionsCatalog"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get the Docker option catalog",
        "tags": [
          "services"
        ]
      }
    },
    "/instance/sign-in-providers/test": {
      "post": {
        "description": "Reads `/.well-known/openid-configuration` of the issuer the way saving a provider does and checks that the document names the same issuer and has the authorization endpoint, token endpoint and key set. Answers 200 either way: `ok` is false with a specific `code` and `message` when the issuer cannot be used.",
        "operationId": "testAuthProvider",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TestIssuerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TestIssuerBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test an OpenID Connect issuer without saving it (instance admin)",
        "tags": [
          "auth"
        ]
      }
    },
    "/instance/upgrade": {
      "get": {
        "description": "The version the control plane runs, whether agents behind it upgrade themselves when they connect, the outcome of the backup the control plane took before its last upgrade, and for every server how its agent's version compares (`behind`, `current`, `ahead`, `unknown`), whether it can be upgraded now (and if not, why) and the state of its latest upgrade.",
        "operationId": "getInstanceUpgrade",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceUpgradeView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Control-plane version, agent version skew per server and the pre-upgrade backup",
        "tags": [
          "servers"
        ]
      },
      "patch": {
        "description": "Needs the `servers:write` scope and the instance admin (the first account). Audited.",
        "operationId": "updateInstanceUpgrade",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceUpgradeView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Switch the automatic agent upgrade",
        "tags": [
          "servers"
        ]
      }
    },
    "/integrations/cloudflare": {
      "delete": {
        "description": "Forgets the token and the zone list. Records NebulaCtrl created stay in Cloudflare (unmanaged) unless `removeRecords=true`.",
        "operationId": "deleteCloudflareIntegration",
        "parameters": [
          {
            "description": "Delete the DNS records NebulaCtrl created from Cloudflare first (the removal is refused when that fails)",
            "explode": false,
            "in": "query",
            "name": "removeRecords",
            "schema": {
              "description": "Delete the DNS records NebulaCtrl created from Cloudflare first (the removal is refused when that fails)",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Disconnect Cloudflare",
        "tags": [
          "integrations"
        ]
      },
      "get": {
        "description": "The API token is never returned.",
        "operationId": "getCloudflareIntegration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CloudflareConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get the Cloudflare connection",
        "tags": [
          "integrations"
        ]
      },
      "put": {
        "description": "Stores a scoped API token (sealed at rest, write-only) after verifying it against Cloudflare and caching its zone list; every domain of the team is matched against the zones. Omit the token to change only the settings. 422 `invalid_token` when Cloudflare rejects the token.",
        "operationId": "putCloudflareIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CloudflareConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Connect Cloudflare",
        "tags": [
          "integrations"
        ]
      }
    },
    "/integrations/cloudflare/test": {
      "post": {
        "description": "Verifies the stored token, refreshes the cached zones and re-matches every domain of the team.",
        "operationId": "testCloudflareIntegration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CloudflareConnectionView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Re-verify the token and refresh the zone list",
        "tags": [
          "integrations"
        ]
      }
    },
    "/integrations/cloudflare/zones": {
      "get": {
        "description": "The cached zone list; empty without a connection.",
        "operationId": "listCloudflareZones",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ZonesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the connected zones (zone picker)",
        "tags": [
          "integrations"
        ]
      }
    },
    "/integrations/tailscale": {
      "delete": {
        "description": "Refused (409 `integration_in_use`) while a server uses a managed tailnet.",
        "operationId": "deleteTailscaleIntegration",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove the Tailscale integration",
        "tags": [
          "integrations"
        ]
      },
      "get": {
        "description": "The OAuth client secret is never returned (`secretSet` only).",
        "operationId": "getTailscaleIntegration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TailscaleIntegration"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get the Tailscale integration",
        "tags": [
          "integrations"
        ]
      },
      "put": {
        "description": "Stores an OAuth client (scopes `auth_keys` and `devices:core`) or, with `provider: headscale`, a Headscale server (login URL plus an API key, or a reusable tagged pre-auth key). The secret is sealed at rest; omit `clientSecret` to keep the stored one. Nothing contacts the control server until the connection test or first use.",
        "operationId": "putTailscaleIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TailscaleIntegration"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Create or update the Tailscale integration",
        "tags": [
          "integrations"
        ]
      }
    },
    "/integrations/tailscale/devices": {
      "get": {
        "operationId": "listTailscaleDevices",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DevicesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List the tailnet's devices (device picker)",
        "tags": [
          "integrations"
        ]
      }
    },
    "/integrations/tailscale/test": {
      "post": {
        "description": "Exchanges a token, lists devices, mints and revokes a 60 second key with the default tags. Leaves no residue.",
        "operationId": "testTailscaleIntegration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TailscaleTestResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test the Tailscale connection",
        "tags": [
          "integrations"
        ]
      }
    },
    "/invites/{token}": {
      "get": {
        "description": "What the invite link offers: team, role, expiry. 404 `invite_invalid`, 410 `invite_expired` or `invite_used` otherwise. Rate limited per IP.",
        "operationId": "previewInvite",
        "parameters": [
          {
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "maxLength": 128,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InvitePreview"
                }
              }
            },
            "description": "OK"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "410": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gone"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Preview an invite (public)",
        "tags": [
          "teams"
        ]
      }
    },
    "/invites/{token}/accept": {
      "post": {
        "description": "Signed in: joins the team and makes it the session's current team. Not signed in: send `name` and `password` (and `email` for link invites) to create the account and join in one step; the session is started. 409 `account_exists` when the email already has an account (sign in instead), 403 `invite_email_mismatch` for an invite sent to another address.",
        "operationId": "acceptInvite",
        "parameters": [
          {
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "maxLength": 128,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AcceptInviteInputBody",
                "description": "Omit when signed in"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcceptedInvite"
                }
              }
            },
            "description": "OK"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "410": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gone"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Accept an invite",
        "tags": [
          "teams"
        ]
      }
    },
    "/links/{linkId}": {
      "delete": {
        "operationId": "deleteLink",
        "parameters": [
          {
            "description": "UUID of a manual link; derived reference links (ref:\u003cfrom\u003e:\u003cto\u003e) cannot be deleted",
            "in": "path",
            "name": "linkId",
            "required": true,
            "schema": {
              "description": "UUID of a manual link; derived reference links (ref:\u003cfrom\u003e:\u003cto\u003e) cannot be deleted",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Remove a link",
        "tags": [
          "links"
        ]
      }
    },
    "/log-drains": {
      "get": {
        "description": "Destinations the servers ship runtime logs to. Credentials are never returned; `servers` carries the drain's health as each server's agent reports it. Requires the admin scope.",
        "operationId": "listLogDrains",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DrainListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List log drains",
        "tags": [
          "logs"
        ]
      },
      "post": {
        "description": "Kinds: `loki` (push URL, tenant, labels; basic auth or bearer token), `otlp` (OTLP/HTTP logs URL; bearer token and/or headers), `syslog` (RFC 5424 over UDP, TCP or TCP+TLS) and `http` (JSON batches to any intake: Datadog, Better Stack, Axiom; credentials as headers, bearer or basic). Every connected server ships its lines from its own host, starting from the moment the drain is saved. Requires the admin scope.",
        "operationId": "createLogDrain",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateDrainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogDrainView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a log drain",
        "tags": [
          "logs"
        ]
      }
    },
    "/log-drains/{drainId}": {
      "delete": {
        "description": "Servers stop shipping and forget the drain's position.",
        "operationId": "deleteLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "drainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete a log drain",
        "tags": [
          "logs"
        ]
      },
      "get": {
        "operationId": "getLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "drainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogDrainView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get a log drain",
        "tags": [
          "logs"
        ]
      },
      "patch": {
        "description": "Omitted fields stay as they are; empty credentials keep the stored ones (`secrets.clear` removes some). The kind cannot change.",
        "operationId": "updateLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "drainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchDrainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogDrainView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update a log drain",
        "tags": [
          "logs"
        ]
      }
    },
    "/log-drains/{drainId}/test": {
      "post": {
        "description": "Sends one test line from a connected server's agent, which is where reachability and credentials count, and returns the outcome (`ok`, a message, the HTTP status). The result is also kept on the drain's `test` state. Works on a disabled drain.",
        "operationId": "testLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "drainId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TestDrainInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogDrainTestResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Send a test line through a drain",
        "tags": [
          "logs"
        ]
      }
    },
    "/me": {
      "get": {
        "operationId": "getMe",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "The authenticated user and principal",
        "tags": [
          "me"
        ]
      },
      "patch": {
        "operationId": "updateMe",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateMeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Update the signed-in user's profile",
        "tags": [
          "me"
        ]
      }
    },
    "/me/2fa/disable": {
      "post": {
        "operationId": "disableTotp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TotpDisableInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Turn 2FA off (needs a code, and the password when the account has one)",
        "tags": [
          "me"
        ]
      }
    },
    "/me/2fa/enable": {
      "post": {
        "description": "Returns the 10 single-use recovery codes once. This session counts as second-factor verified afterwards.",
        "operationId": "enableTotp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TotpEnableInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryCodesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Confirm the authenticator and turn 2FA on",
        "tags": [
          "me"
        ]
      }
    },
    "/me/2fa/recovery-codes": {
      "post": {
        "description": "Invalidates every previous code and returns 10 new ones, shown once.",
        "operationId": "regenerateRecoveryCodes",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegenerateRecoveryCodesInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecoveryCodesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Replace the recovery codes (needs a current code)",
        "tags": [
          "me"
        ]
      }
    },
    "/me/2fa/setup": {
      "post": {
        "description": "Replaces any unconfirmed secret. Confirm it with POST /me/2fa/enable. Returns 409 when 2FA is already on.",
        "operationId": "startTotpEnrolment",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TotpSetupOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Generate a TOTP secret to add to an authenticator app",
        "tags": [
          "me"
        ]
      }
    },
    "/me/identities/{id}": {
      "delete": {
        "operationId": "unlinkIdentity",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Unlink a single-sign-on account",
        "tags": [
          "me"
        ]
      }
    },
    "/me/passkeys": {
      "get": {
        "operationId": "listPasskeys",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeysOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "The signed-in user's passkeys",
        "tags": [
          "me"
        ]
      },
      "post": {
        "description": "Counts as a second factor for the team 2FA requirement. When the account has no unused recovery code left, a fresh set is issued and returned once.",
        "operationId": "finishPasskeyRegistration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyRegisterFinishInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasskeyRegisterFinishOutputBody"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Finish adding a passkey",
        "tags": [
          "me"
        ]
      }
    },
    "/me/passkeys/options": {
      "post": {
        "description": "Returns the WebAuthn creation options for `navigator.credentials.create`; the answer goes to `POST /me/passkeys`. Needs the password again when the account has one. Passkeys are discoverable credentials with user verification required.",
        "operationId": "startPasskeyRegistration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyRegisterStartInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "description": "WebAuthn PublicKeyCredentialCreationOptions or PublicKeyCredentialRequestOptions wrapped as {publicKey: {...}}"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Start adding a passkey",
        "tags": [
          "me"
        ]
      }
    },
    "/me/passkeys/{id}": {
      "delete": {
        "description": "Fails with 409 `last_sign_in_method` when it is the account's only way to sign in.",
        "operationId": "deletePasskey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyDeleteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Remove a passkey (needs the password when the account has one)",
        "tags": [
          "me"
        ]
      },
      "patch": {
        "operationId": "renamePasskey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PasskeyRenameInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Rename a passkey",
        "tags": [
          "me"
        ]
      }
    },
    "/me/password": {
      "post": {
        "operationId": "changePassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ChangePasswordInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Change the signed-in user's password",
        "tags": [
          "me"
        ]
      }
    },
    "/me/security": {
      "get": {
        "operationId": "getMySecurity",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecurityBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Two-factor and linked-account status of the signed-in user",
        "tags": [
          "me"
        ]
      }
    },
    "/mesh": {
      "get": {
        "description": "The managed tailnet mesh: coordinator health, the ACL mode and state, the server nodes, the link nodes, the access rules NebulaCtrl derives (read-only) and the tagged device count. Servers join the mesh one by one; replicas and cross-server service links use it.",
        "operationId": "getMesh",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/View"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Server mesh of the team",
        "tags": [
          "mesh"
        ]
      }
    },
    "/mesh/acl/apply": {
      "post": {
        "description": "Regenerates and applies the policy according to the ACL mode (managed writes it, advisory only verifies it). It normally runs by itself a few seconds after every change.",
        "operationId": "applyMeshACL",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/View"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Apply the access rules now",
        "tags": [
          "mesh"
        ]
      }
    },
    "/mesh/acl/check": {
      "post": {
        "description": "Read-only drift check: which generated rules are missing from the tailnet policy and which outdated NebulaCtrl rules it still holds. It cannot prove that no broader rule exists; the connectivity test is the ground truth.",
        "operationId": "checkMeshACL",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ACLCheck"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Compare the generated rules with the stored policy",
        "tags": [
          "mesh"
        ]
      }
    },
    "/mesh/acl/preview": {
      "post": {
        "description": "The rules derived from the mesh tables, the policy document (managed Headscale) or the snippet to paste (advisory), and, when the stored policy can be read, what would be added or removed. Nothing is written.",
        "operationId": "previewMeshACL",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ACLPreview"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Preview the generated access rules",
        "tags": [
          "mesh"
        ]
      }
    },
    "/mesh/links/{linkId}/reprovision": {
      "post": {
        "description": "Re-creates a link node with a fresh single-use key (a new device and tailnet IP; the access rules regenerate).",
        "operationId": "reprovisionMeshLink",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "linkId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcceptedOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Re-provision a link node",
        "tags": [
          "mesh"
        ]
      }
    },
    "/mesh/settings": {
      "put": {
        "description": "Auto-join, the mesh tag and the ACL mode. Switching Tailscale to `managed` is an opt-in: it needs the OAuth client's `policy_file` scope, refuses when another team uses the same tailnet (409 `mesh_acl_shared_tailnet`) and answers 422 `mesh_policy_scope_missing` when the scope is missing. The token can then rewrite the whole tailnet policy; NebulaCtrl itself replaces only its own rules and keeps comments. Changing the ACL mode or the tag needs the admin scope.",
        "operationId": "updateMeshSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SettingsInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/View"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Change the mesh settings",
        "tags": [
          "mesh"
        ]
      }
    },
    "/networks": {
      "get": {
        "description": "Needs `servers:read`. Each network lives on one server and lists the services attached to it.",
        "operationId": "listNetworks",
        "parameters": [
          {
            "description": "Only the networks on this server",
            "explode": false,
            "in": "query",
            "name": "serverId",
            "schema": {
              "description": "Only the networks on this server",
              "format": "uuid",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListNetworksOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "List the team's shared networks",
        "tags": [
          "networks"
        ]
      },
      "post": {
        "description": "Needs `servers:write`. A shared network spans one server: services of any project of the team that run on it attach explicitly and are reachable by `\u003cservice\u003e.\u003cenv\u003e.\u003cproject\u003e`. 409 `network_name_taken`, 422 `server_not_found`.",
        "operationId": "createNetwork",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateNetworkInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NetworkView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Create a shared network",
        "tags": [
          "networks"
        ]
      }
    },
    "/networks/{networkId}": {
      "delete": {
        "description": "Needs `servers:write`. 409 `network_in_use` while a service is attached.",
        "operationId": "deleteNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "networkId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Delete a shared network",
        "tags": [
          "networks"
        ]
      },
      "get": {
        "operationId": "getNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "networkId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NetworkView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Get a shared network",
        "tags": [
          "networks"
        ]
      }
    },
    "/notifications/alert-settings": {
      "get": {
        "description": "How long a service must be down, unhealthy or restarting before service.crashed, service.unhealthy and service.restart_loop are sent, when an incident closes, and when a backup counts as missed. Which channel receives which event is the channel's own event selection.",
        "operationId": "getServiceAlertSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get the service alert thresholds",
        "tags": [
          "notifications"
        ]
      },
      "put": {
        "description": "Replaces every threshold. Takes effect within a minute.",
        "operationId": "updateServiceAlertSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SettingsView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Set the service alert thresholds",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/channels": {
      "get": {
        "description": "Credentials are never returned; `secrets` holds masked hints of the ones that are set.",
        "operationId": "listNotificationChannels",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List notification channels",
        "tags": [
          "notifications"
        ]
      },
      "post": {
        "description": "Kinds: `email` (SMTP: host, port, tls implicit|starttls|none, username, from, to; password in `secrets`), `slack` and `discord` (webhook URL in `secrets.url`), `telegram` (`config.chatId`, bot token in `secrets.botToken`) and `webhook` (URL in `secrets.url`; every request is signed with HMAC-SHA256 in the `X-NebulaCtrl-Signature` header). A webhook's signing secret is generated when omitted and returned once. Not idempotent: the response can carry that secret, so a repeated name answers 409 `channel_conflict` instead of replaying it. Requires the admin scope.",
        "operationId": "createNotificationChannel",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateChannelInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreateChannelOutputBody"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a notification channel",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/channels/{channelId}": {
      "delete": {
        "description": "Deletes the channel and its delivery log.",
        "operationId": "deleteNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete a notification channel",
        "tags": [
          "notifications"
        ]
      },
      "get": {
        "operationId": "getNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get a notification channel",
        "tags": [
          "notifications"
        ]
      },
      "patch": {
        "description": "Omitted fields stay as they are; empty credentials keep the stored ones. The kind can not change.",
        "operationId": "updateNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchChannelInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update a notification channel",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/channels/{channelId}/deliveries": {
      "get": {
        "description": "The delivery log, newest first, kept for 30 days: status (`pending`, `retrying`, `delivered`, `failed`), attempts, the last error and the response code. Errors never contain credentials.",
        "operationId": "listNotificationDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Only deliveries in this status.",
            "explode": false,
            "in": "query",
            "name": "status",
            "schema": {
              "description": "Only deliveries in this status.",
              "enum": [
                "pending",
                "retrying",
                "delivered",
                "failed"
              ],
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelDeliveryPage"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List a channel's deliveries",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/channels/{channelId}/rotate-secret": {
      "post": {
        "description": "Webhook channels only. The new secret is returned once; deliveries are signed with it from now on.",
        "operationId": "rotateNotificationChannelSecret",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RotateOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Rotate a webhook signing secret",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/channels/{channelId}/test": {
      "post": {
        "description": "Sends a test message through the channel right now and returns the delivery that records the result (status `delivered` or `failed`, with the error and response code). The test is not queued, retried, rate limited or deduplicated, and works on a disabled channel. It also updates the channel's `test` state.",
        "operationId": "testNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "channelId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChannelDelivery"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Send a test notification",
        "tags": [
          "notifications"
        ]
      }
    },
    "/notifications/event-types": {
      "get": {
        "description": "The events a channel can subscribe to, grouped, with their default severity and whether new channels subscribe by default.",
        "operationId": "listNotificationEventTypes",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventTypesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List notification event types",
        "tags": [
          "notifications"
        ]
      }
    },
    "/platform-services": {
      "get": {
        "description": "Services NebulaCtrl runs for its own use (S3 storage, a log store, a tailnet control server, single sign-on), each wired into the integration that asked for it.",
        "operationId": "listPlatformServices",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformListing"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Platform services: the catalog and what is set up",
        "tags": [
          "platform"
        ]
      },
      "post": {
        "description": "Stages the service in the team's system project, deploys it, then wires it into the integration (a backup destination, a log drain, the Tailscale integration or a sign-in provider) with generated credentials and tests the connection. Returns 202; poll the service (or listen to events) until `status` is `ready` or `failed`. Not idempotent-keyed: the response of the identity provider carries a one-time password.",
        "operationId": "createPlatformService",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProvisionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformProvisionBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Set up a platform service for me",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}": {
      "delete": {
        "description": "`confirm` must equal the kind. The integration is removed first; an integration still in use (a backup destination with schedules or stored backups, a tailnet in use, people who sign in only through the provider) answers 409 and nothing changes. `deleteData` also deletes the data volumes.",
        "operationId": "deletePlatformService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Must equal the kind.",
            "explode": false,
            "in": "query",
            "name": "confirm",
            "schema": {
              "description": "Must equal the kind.",
              "type": "string"
            }
          },
          {
            "description": "Also delete the data volumes.",
            "explode": false,
            "in": "query",
            "name": "deleteData",
            "schema": {
              "description": "Also delete the data volumes.",
              "type": "boolean"
            }
          },
          {
            "description": "Single sign-on: remove it although people can sign in only through it.",
            "explode": false,
            "in": "query",
            "name": "force",
            "schema": {
              "description": "Single sign-on: remove it although people can sign in only through it.",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a platform service and unwire its integration",
        "tags": [
          "platform"
        ]
      },
      "get": {
        "operationId": "getPlatformService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformServiceView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Get a platform service",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/admin-link": {
      "post": {
        "description": "Asks Pocket ID for a one-time access token for the administrator created at set-up and returns the link. The link works once and expires after an hour. It is shown once: it is never stored, logged or audited (the audit entry says who asked). Pocket ID has no passwords: the link signs the person in, and they register a passkey from their account page. Only for the Pocket ID variant of single sign-on.",
        "operationId": "createPlatformAdminLink",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AdminLink"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Create a one-time sign-in link for the first administrator of Pocket ID (instance administrators)",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/backup": {
      "put": {
        "description": "Uses the volume backup feature (restic) with the chosen destination: daily at 03:17 UTC, 7 daily, 4 weekly and 3 monthly kept.",
        "operationId": "setPlatformBackup",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformServiceView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Schedule a daily volume backup of a platform service's data",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/reconnect": {
      "post": {
        "description": "Headscale mints a new API key and updates the Tailscale integration; the others re-create a missing destination or drain and test it again.",
        "operationId": "reconnectPlatformService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformServiceView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Run the wiring of a ready platform service again",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/retry": {
      "post": {
        "operationId": "retryPlatformService",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformServiceView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Retry a failed platform service",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/reveal": {
      "post": {
        "operationId": "revealPlatformCredentials",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevealOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Reveal the generated credentials of a platform service (audited)",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/users": {
      "get": {
        "operationId": "listPlatformUsers",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UsersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "People of the single sign-on provider",
        "tags": [
          "platform"
        ]
      },
      "post": {
        "description": "Rewrites the users file in the service's configuration and deploys it. Without a password one is generated and returned once.",
        "operationId": "addPlatformUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AddUserInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformUserChange"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a person to the single sign-on provider (instance administrators)",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/users/{username}": {
      "delete": {
        "operationId": "removePlatformUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "username",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformUserChange"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a person from the single sign-on provider (instance administrators)",
        "tags": [
          "platform"
        ]
      }
    },
    "/platform-services/{id}/users/{username}/reset-password": {
      "post": {
        "operationId": "resetPlatformUserPassword",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "username",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ResetInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PlatformUserChange"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Set a new password for a person (instance administrators)",
        "tags": [
          "platform"
        ]
      }
    },
    "/previews/{previewId}": {
      "delete": {
        "description": "Removes the preview's services, containers, volumes and domains, then its environment. Runs asynchronously.",
        "operationId": "deletePreview",
        "parameters": [
          {
            "in": "path",
            "name": "previewId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PreviewView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a pull-request preview",
        "tags": [
          "previews"
        ]
      }
    },
    "/projects": {
      "get": {
        "operationId": "listProjects",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageProject"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List projects",
        "tags": [
          "projects"
        ]
      },
      "post": {
        "operationId": "createProject",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateProjectInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Create a project (with its production environment)",
        "tags": [
          "projects"
        ]
      }
    },
    "/projects/{projectId}": {
      "delete": {
        "description": "Fails with 409 `project_not_empty` while the project still has services.",
        "operationId": "deleteProject",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete an empty project",
        "tags": [
          "projects"
        ]
      },
      "get": {
        "operationId": "getProject",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a project",
        "tags": [
          "projects"
        ]
      },
      "patch": {
        "operationId": "updateProject",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateProjectInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Project"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update a project",
        "tags": [
          "projects"
        ]
      }
    },
    "/projects/{projectId}/environments": {
      "get": {
        "operationId": "listEnvironments",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageEnvironment"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a project's environments",
        "tags": [
          "environments"
        ]
      },
      "post": {
        "operationId": "createEnvironment",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateEnvironmentInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Environment"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Create an environment",
        "tags": [
          "environments"
        ]
      }
    },
    "/projects/{projectId}/environments/{environmentId}/canvas": {
      "get": {
        "description": "`version` 0 with an empty layout means nothing was saved yet. The ETag is the version.",
        "operationId": "getCanvas",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Canvas"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get an environment's canvas layout",
        "tags": [
          "canvas"
        ]
      },
      "put": {
        "description": "Requires `If-Match: \"\u003cversion\u003e\"`; a stale version returns 412 `layout_conflict`. The layout is presentation only and never affects deployments.",
        "operationId": "putCanvas",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "environmentId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The ETag (version) from the last GET. Use \"0\" for the first save.",
            "in": "header",
            "name": "If-Match",
            "schema": {
              "description": "The ETag (version) from the last GET. Use \"0\" for the first save.",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutInputBody3"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Canvas"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Failed"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "428": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Required"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Save an environment's canvas layout",
        "tags": [
          "canvas"
        ]
      }
    },
    "/projects/{projectId}/previews": {
      "get": {
        "operationId": "listPreviews",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListOutputBody2"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a project's pull-request previews",
        "tags": [
          "previews"
        ]
      }
    },
    "/projects/{projectId}/previews/settings": {
      "get": {
        "operationId": "getPreviewSettings",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PreviewSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a project's pull-request preview settings",
        "tags": [
          "previews"
        ]
      },
      "put": {
        "description": "Previews clone the base environment for every open pull request of a connected repository. Fork pull requests are off by default; a fork preview never receives secrets.",
        "operationId": "updatePreviewSettings",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutSettingsInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PreviewSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update a project's pull-request preview settings",
        "tags": [
          "previews"
        ]
      }
    },
    "/projects/{projectId}/shared-variables": {
      "get": {
        "description": "Shared variables reach a service only through an explicit `KEY=${{shared.KEY}}` variable (see share). An environment value overrides the project value for that environment. Shared values may only reference other shared variables, team variables, external secrets, generators and transforms.",
        "operationId": "listProjectSharedVariables",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a project's shared variables",
        "tags": [
          "shared-variables"
        ]
      },
      "put": {
        "operationId": "putProjectSharedVariables",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SharedVariablesPutBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Upsert project shared variables (restages consumers in every environment)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/projects/{projectId}/shared-variables/{key}": {
      "delete": {
        "operationId": "deleteProjectSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a project shared variable",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/projects/{projectId}/shared-variables/{key}/history": {
      "get": {
        "operationId": "getProjectSharedVariableHistory",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HistoryOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Version history of a project shared variable",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/projects/{projectId}/shared-variables/{key}/rotate": {
      "post": {
        "operationId": "rotateProjectSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VariableRotateBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableRotationPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Rotate a generated project shared variable (plan or stage)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/projects/{projectId}/shared-variables/{key}/share": {
      "post": {
        "operationId": "shareProjectSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ShareSharedInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Stage KEY=${{shared.KEY}} on services",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/projects/{projectId}/terminal-settings": {
      "get": {
        "operationId": "getTerminalSettings",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "A project's terminal settings",
        "tags": [
          "terminal"
        ]
      },
      "put": {
        "description": "Admins and Owners only. `allowProductionFileWrites` lets the file browser upload files in the project's production environments (default off). Audited.",
        "operationId": "setTerminalSettings",
        "parameters": [
          {
            "in": "path",
            "name": "projectId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TerminalSettingsView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Change a project's terminal settings",
        "tags": [
          "terminal"
        ]
      }
    },
    "/registries": {
      "get": {
        "description": "Bring-your-own (external) and managed registries. Credentials are write-only and never returned.",
        "operationId": "listRegistries",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListOutputBody3"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List registries",
        "tags": [
          "registries"
        ]
      },
      "post": {
        "description": "Adds a registry that takes basic auth (GHCR, Docker Hub, GitLab, Harbor, self-hosted). Credentials are sealed and write-only. ECR, GAR and ACR tokens that expire are not supported. The managed registry is set up with POST /platform-services (kind registry). Requires the admin scope.",
        "operationId": "createRegistry",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateInputBody2"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistryView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add an external registry",
        "tags": [
          "registries"
        ]
      }
    },
    "/registries/{registryId}": {
      "delete": {
        "description": "409 `registry_in_use` while a team default, a project or a service override uses it. A managed registry is removed with its platform service (409 `managed_registry`). Images already pushed stay in the registry.",
        "operationId": "deleteRegistry",
        "parameters": [
          {
            "in": "path",
            "name": "registryId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete an external registry",
        "tags": [
          "registries"
        ]
      },
      "get": {
        "operationId": "getRegistry",
        "parameters": [
          {
            "in": "path",
            "name": "registryId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistryView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a registry",
        "tags": [
          "registries"
        ]
      },
      "patch": {
        "description": "Omitted fields stay as they are; an omitted password keeps the stored one. A managed registry can only be renamed and have its retention switched.",
        "operationId": "updateRegistry",
        "parameters": [
          {
            "in": "path",
            "name": "registryId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistryView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update a registry",
        "tags": [
          "registries"
        ]
      }
    },
    "/registries/{registryId}/check": {
      "post": {
        "description": "The agent on the chosen server contacts the registry with the stored credentials and reports whether push and pull are accepted. Waits up to 25 seconds; if the agent has not answered by then the response has `pending: true` and the result appears in the registry's `lastCheck`.",
        "operationId": "checkRegistry",
        "parameters": [
          {
            "in": "path",
            "name": "registryId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The server whose agent runs the check. Builds and pulls reach the registry from servers, so this is the test that matters.",
            "explode": false,
            "in": "query",
            "name": "serverId",
            "schema": {
              "description": "The server whose agent runs the check. Builds and pulls reach the registry from servers, so this is the test that matters.",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistryCheck"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test a registry from a server",
        "tags": [
          "registries"
        ]
      }
    },
    "/registries/{registryId}/images": {
      "get": {
        "description": "Newest first. `live` images are inside the rollback window, `expired` ones are outside it (a managed registry deletes them at the next sweep), `deleted` ones are gone.",
        "operationId": "listRegistryImages",
        "parameters": [
          {
            "in": "path",
            "name": "registryId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Only images in this state.",
            "explode": false,
            "in": "query",
            "name": "state",
            "schema": {
              "description": "Only images in this state.",
              "enum": [
                "live",
                "expired",
                "deleted"
              ],
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50).",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "description": "Page size (default 50).",
              "format": "int64",
              "maximum": 200,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistryImagePage"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the images pushed to a registry",
        "tags": [
          "registries"
        ]
      }
    },
    "/retired-volumes/{retiredId}": {
      "delete": {
        "description": "Enqueues the removal on the server; the row disappears once the agent confirmed. 409 `server_offline` while the server is offline.",
        "operationId": "deleteRetiredVolume",
        "parameters": [
          {
            "in": "path",
            "name": "retiredId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Delete a retired Docker volume",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/routes/{routeId}": {
      "delete": {
        "description": "Frees the listen port and removes the route from its server's table (a sync is queued atomically). `DELETE /services/{id}` does the same.",
        "operationId": "deleteRoute",
        "parameters": [
          {
            "in": "path",
            "name": "routeId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Delete a route service",
        "tags": [
          "routes"
        ]
      },
      "get": {
        "operationId": "getRoute",
        "parameters": [
          {
            "in": "path",
            "name": "routeId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a route service",
        "tags": [
          "routes"
        ]
      },
      "patch": {
        "description": "Requires `If-Match: \"\u003cgeneration\u003e\"`. The protocol and server cannot be changed. Same 4xx codes as create; 412 `generation_conflict` for a stale generation.",
        "operationId": "updateRoute",
        "parameters": [
          {
            "in": "path",
            "name": "routeId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The ETag (generation) from the last GET, e.g. \"3\". Required.",
            "in": "header",
            "name": "If-Match",
            "schema": {
              "description": "The ETag (generation) from the last GET, e.g. \"3\". Required.",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateRouteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Failed"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "428": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Required"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Update a route service (staged until deployed)",
        "tags": [
          "routes"
        ]
      }
    },
    "/secret-managers": {
      "get": {
        "description": "Variables reference a secret as `${{vault:\u003cname\u003e/\u003cpath\u003e#\u003ckey\u003e}}` or, for Doppler, `${{doppler:\u003cname\u003e/\u003cproject\u003e/\u003cconfig\u003e#\u003ckey\u003e}}`. The value is fetched when a deploy sends its command and is never stored. Credentials are never returned (`secretSet` only). `scope` and `grants` say which projects and environments may reference the integration.",
        "operationId": "listSecretManagers",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the team's external secret manager integrations",
        "tags": [
          "secret-managers"
        ]
      },
      "post": {
        "description": "HashiCorp Vault / OpenBao: KV v2 with a token or AppRole. Infisical: a machine identity (universal auth). Doppler: a service token (bound to one config) or a personal / service account token. Nothing contacts the manager until the test or the first deploy that references it. Admin scope.",
        "operationId": "createSecretManager",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretManager"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Add a secret manager integration",
        "tags": [
          "secret-managers"
        ]
      }
    },
    "/secret-managers/{id}": {
      "delete": {
        "description": "Refused with 409 `integration_in_use` while a variable references it.",
        "operationId": "deleteSecretManager",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a secret manager integration",
        "tags": [
          "secret-managers"
        ]
      },
      "put": {
        "description": "The name and kind are fixed. Changing the address, auth method or identity requires the credential again. Omitting `scope` keeps the stored scope and grants. Admin scope.",
        "operationId": "updateSecretManager",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SecretManagerBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretManager"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Update a secret manager integration",
        "tags": [
          "secret-managers"
        ]
      }
    },
    "/secret-managers/{id}/test": {
      "post": {
        "description": "Signs in and, when `path` and `key` are given, reads that secret. The value is discarded and never returned.",
        "operationId": "testSecretManager",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TestInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretManagerTestResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Test a secret manager integration",
        "tags": [
          "secret-managers"
        ]
      }
    },
    "/servers": {
      "get": {
        "operationId": "listServers",
        "parameters": [
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageServer"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "List servers",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/agent-upgrades": {
      "post": {
        "description": "Upgrades the given servers (every server whose agent can be upgraded now when none are given) in name order. Each upgrade must be confirmed by the agent reconnecting with the new version before the next one starts; the first failure stops the rollout and leaves the remaining servers untouched. Needs the Owner or Admin role; audited. 409 `nothing_to_upgrade` when no agent qualifies.",
        "operationId": "upgradeServerAgents",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FleetInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RolloutView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Upgrade agents one server at a time (staged)",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/enrollment-tokens": {
      "post": {
        "description": "The token is valid for one hour and can enroll exactly one agent. It is returned only in this response (and in an idempotent replay of it).",
        "operationId": "createEnrollmentToken",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateTokenInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnrollmentToken"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Create a pending server and a one-time enrollment token",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}": {
      "get": {
        "operationId": "getServer",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Server"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Get a server",
        "tags": [
          "servers"
        ]
      },
      "patch": {
        "operationId": "updateServer",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateServerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Server"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Update a server's name, host settings, retention or alert settings",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/agent-upgrade": {
      "post": {
        "description": "The agent downloads the binary from this control plane, checks its SHA-256 against the one in the command, replaces itself, restarts when its running work is done and rolls back if the new binary does not start. Needs the Owner or Admin role; audited. 409 `server_offline`, `agent_current`, `agent_newer` or `upgrade_in_progress`; 422 `agent_predates_upgrade` (re-run the agent installer once) or `no_agent_binary`.",
        "operationId": "upgradeServerAgent",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerUpgradeView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Upgrade one server's agent to the control plane's version",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/analytics": {
      "get": {
        "description": "Same payload as the service report plus `unrouted` (requests that matched no service). Window to report. Minute data covers 24 hours; longer ranges read hourly (default 7 days kept) or daily (90 days) rows.",
        "operationId": "getServerAnalytics",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Window to report",
            "explode": false,
            "in": "query",
            "name": "range",
            "schema": {
              "default": "24h",
              "description": "Window to report",
              "enum": [
                "5m",
                "10m",
                "15m",
                "30m",
                "1h",
                "6h",
                "12h",
                "24h",
                "7d",
                "30d",
                "90d"
              ],
              "type": "string"
            }
          },
          {
            "description": "prev adds the previous equal window as comparison",
            "explode": false,
            "in": "query",
            "name": "compare",
            "schema": {
              "description": "prev adds the previous equal window as comparison",
              "enum": [
                "",
                "prev"
              ],
              "type": "string"
            }
          },
          {
            "description": "Restrict to one hostname",
            "explode": false,
            "in": "query",
            "name": "host",
            "schema": {
              "description": "Restrict to one hostname",
              "maxLength": 253,
              "type": "string"
            }
          },
          {
            "description": "true (default) ranks top paths by page views (documents); false ranks every request",
            "explode": false,
            "in": "query",
            "name": "pages",
            "schema": {
              "default": true,
              "description": "true (default) ranks top paths by page views (documents); false ranks every request",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Report"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Traffic analytics of every host on a server",
        "tags": [
          "analytics"
        ]
      }
    },
    "/servers/{serverId}/certificates": {
      "get": {
        "operationId": "listCertificates",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificatesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "List a server's custom certificates",
        "tags": [
          "certificates"
        ]
      },
      "post": {
        "description": "Needs `proxy:write`. The leaf is the first certificate of the chain; encrypted keys, mismatching keys, expired and not-yet-valid certificates and certificates without a SAN are rejected. The key is sealed at rest and never returned.",
        "operationId": "uploadCertificate",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UploadCertificateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerCertificate"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Upload a custom TLS certificate (staged until the proxy is deployed)",
        "tags": [
          "certificates"
        ]
      }
    },
    "/servers/{serverId}/cleanup": {
      "get": {
        "description": "Whether the scheduled cleanup is on, when it runs next and the most recent runs with what each prune step removed. A cleanup removes dangling images, unused images older than `unusedImageMinAgeHours` (default 72), build cache older than `buildCacheMinAgeDays` (default 7) and unused NebulaCtrl networks, and optionally stopped containers NebulaCtrl does not manage. It never removes the current or a rollback-eligible release's image, a pinned infrastructure image, or any volume.",
        "operationId": "getServerCleanup",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CleanupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Docker cleanup settings and history of a server",
        "tags": [
          "servers"
        ]
      },
      "put": {
        "description": "Needs the `servers:write` scope. `cron` sets the schedule (UTC), `unusedImageMinAgeHours` and `buildCacheMinAgeDays` the age limits and `diskTriggerPercent` the disk usage that starts an emergency run (omitted or 0: the server's disk alert threshold); omitted or 0 keeps each default. Turning the schedule off also turns off the emergency run; \"Run cleanup now\" still works. 422 `validation_failed` for a bad cron expression (or one that fires more often than every 15 minutes) or an out-of-range value.",
        "operationId": "updateServerCleanup",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateCleanupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CleanupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Change the Docker cleanup settings of a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/cleanup/runs": {
      "post": {
        "description": "Queues the same cleanup the schedule runs. The result (reclaimed bytes, items per step) appears in the server's cleanup history. 409 `server_offline` when the server is offline, 409 `cleanup_running` while one is in flight.",
        "operationId": "runServerCleanup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CleanupRun"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Run the Docker cleanup of a server now",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/cleanup/volumes": {
      "post": {
        "description": "Removes volumes that no container (running or stopped) mounts and that NebulaCtrl does not manage: anonymous volumes and volumes made outside NebulaCtrl. Volumes of NebulaCtrl services (`nc-vol-*`, or labeled as managed) are never removed. This deletes data and cannot be undone: `confirm` must be the server's name. The schedule never does this.",
        "operationId": "pruneServerVolumes",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PruneVolumesInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CleanupRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Remove unused Docker volumes of a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/dns01": {
      "get": {
        "description": "Desired state with staged additions, updates and removals marked; certificate status and expiry are observed by the agent.",
        "operationId": "getServerDns01",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "A server's DNS-01 resolvers and wildcard certificates",
        "tags": [
          "dns01"
        ]
      }
    },
    "/servers/{serverId}/dns01/resolvers/{provider}": {
      "delete": {
        "description": "409 `resolver_in_use` while a wildcard certificate or a domain of a service on the server uses it.",
        "operationId": "deleteServerDns01Resolver",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage the removal of a resolver",
        "tags": [
          "dns01"
        ]
      },
      "put": {
        "description": "Needs `proxy:write`. One resolver per provider and server. Staged until `POST /servers/{id}/proxy/deploy`, which recreates the proxy container. 422 `acme_email_required`, `invalid_credential`, `agent_too_old`.",
        "operationId": "setServerDns01Resolver",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetResolverInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage the DNS-01 resolver of a provider on a server",
        "tags": [
          "dns01"
        ]
      }
    },
    "/servers/{serverId}/dns01/wildcards": {
      "post": {
        "description": "Needs `proxy:write` and the provider's resolver on the server (422 `resolver_not_configured`). The certificate covers `*.\u003cdomain\u003e` (and the apex with `includeApex`); `coverGenerated` lets generated domains use it; `default` makes it the proxy's default certificate. 409 `wildcard_exists`.",
        "operationId": "createServerWildcardCert",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateWildcardInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerDNS01"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage a wildcard certificate",
        "tags": [
          "dns01"
        ]
      }
    },
    "/servers/{serverId}/drain": {
      "get": {
        "operationId": "getServerDrain",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GetDrainOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read",
              "projects:read"
            ]
          },
          {
            "cookie": [
              "servers:read",
              "projects:read"
            ]
          }
        ],
        "summary": "Progress of a server's drain",
        "tags": [
          "fleet"
        ]
      },
      "post": {
        "description": "Marks the server as draining (nothing new is placed on it) and moves its services one at a time: each move changes the placement and deploys the service to the target; the old container is removed once the new one is live. The first failed move stops the drain and leaves the remaining services untouched. Scopes: servers:write, deployments:write, projects:write.",
        "operationId": "startServerDrain",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StartInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DrainView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "deployments:write",
              "projects:write"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "deployments:write",
              "projects:write"
            ]
          }
        ],
        "summary": "Drain a server",
        "tags": [
          "fleet"
        ]
      }
    },
    "/servers/{serverId}/drain/cancel": {
      "post": {
        "description": "The drain ends after the current move. The server returns to `none` when nothing was moved yet, otherwise it becomes `failed` with \"Canceled after N of M moves\".",
        "operationId": "cancelServerDrain",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DrainView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Stop a drain after the move in flight",
        "tags": [
          "fleet"
        ]
      }
    },
    "/servers/{serverId}/drain/plan": {
      "post": {
        "description": "Dry run: proposes a target for every service on the server, flags stateful services (volumes are not copied), and checks that the targets have the memory. Requires a token that is not restricted to projects.",
        "operationId": "planServerDrain",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PlanInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DrainPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read",
              "projects:read"
            ]
          },
          {
            "cookie": [
              "servers:read",
              "projects:read"
            ]
          }
        ],
        "summary": "Plan evacuating a server",
        "tags": [
          "fleet"
        ]
      }
    },
    "/servers/{serverId}/hardening": {
      "get": {
        "description": "The Security tab: Lynis's hardening index from the latest audit, every curated safe fix with its state on the host (applied, already compliant, pending, unavailable), the findings that remain with an explanation and the commands to deal with them, and the history of runs. NebulaCtrl never offers a fix for SSH, the firewall or accounts.",
        "operationId": "getServerHardening",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HardeningView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Host hardening of a server: the Lynis index, the safe fixes and what is left",
        "tags": [
          "servers"
        ]
      },
      "put": {
        "description": "Needs the `servers:write` scope and the Owner or Admin role. Audited.",
        "operationId": "updateServerHardening",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HardeningView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Switch the weekly Lynis audit of a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/hardening/apply": {
      "post": {
        "description": "Applies the selected fixes (the default set when none is selected), checks each one and undoes it by itself if it did not take effect, then audits again so the new index is known. Each fix is reversible with the rollback endpoint. Never changes SSH, the firewall or accounts. Needs the Owner or Admin role; audited.",
        "operationId": "applyServerHardening",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FixesInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HardeningRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Apply safe hardening fixes",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/hardening/audit": {
      "post": {
        "description": "Queues a Lynis audit on the server. It only reads the host. With `installLynis`, the agent first installs Lynis (from CISOfy's repository, else the distribution's). Needs the Owner or Admin role. 409 `server_offline` when the server is offline, 409 `hardening_running` while a run is in flight.",
        "operationId": "runServerHardeningAudit",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AuditInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HardeningRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Audit the host with Lynis now",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/hardening/rollback": {
      "post": {
        "description": "Restores what NebulaCtrl changed for the selected fixes: the previous sysctl values, file modes, login.defs lines and banners. A fix NebulaCtrl did not apply is left alone. Needs the Owner or Admin role; audited.",
        "operationId": "rollbackServerHardening",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FixesInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HardeningRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Undo safe hardening fixes",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/host-shell": {
      "get": {
        "description": "Whether the caller can open a shell on the server itself, and why not: the setting is off (the default), the caller's account has no two-factor authentication, or the server is offline. Owners and Admins with a signed-in session only; a token gets 403 `session_required`.\n\n**Shell.** `GET /servers/{serverId}/shell/ws` upgrades to a WebSocket with the protocol of the service terminal (see `getServiceTerminal`): the first message is JSON `{\"type\":\"open\",\"cols\":80,\"rows\":24,\"confirmProduction\":false}` (no command: it is always the host's login shell). It answers 403 `host_shell_disabled` when the setting is off and 403 `two_factor_required` when the account has no 2FA, before the upgrade. A server that runs any service of a production environment needs `confirmProduction: true`. A person may hold 2 host shells; an idle session (no input for 15 minutes) is closed. Sessions are audited (`server.shell.open`, `server.shell.close`: who, server, duration); their I/O is never recorded.",
        "operationId": "getServerHostShell",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HostShellInfoView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Host shell availability of a server",
        "tags": [
          "terminal"
        ]
      },
      "put": {
        "description": "Owners and Admins only (signed-in session). Off by default. The host shell is a root shell on the server: switching it on is audited (`server.shell.enable`, `server.shell.disable`), and switching it off ends the sessions that are open.",
        "operationId": "setServerHostShell",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/HostShellSettingsView"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HostShellSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Switch a server's host shell on or off",
        "tags": [
          "terminal"
        ]
      }
    },
    "/servers/{serverId}/log-settings": {
      "get": {
        "description": "Capture on or off, retention days and size caps, with the usage the agent last reported.",
        "operationId": "getServerLogSettings",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "A server's log history settings",
        "tags": [
          "logs"
        ]
      },
      "put": {
        "description": "Retention 1-90 days (default 7); size caps of at least 32 MB (defaults 500 MB per service, 5 GB per server; the oldest lines go first). The agent applies them at once.",
        "operationId": "updateServerLogSettings",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutSettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogSettingsView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Change a server's log history settings",
        "tags": [
          "logs"
        ]
      }
    },
    "/servers/{serverId}/mesh": {
      "get": {
        "description": "Whether the server joined the mesh, its node (state, tailnet addresses, peers, exposed services) and the link nodes that run on it.",
        "operationId": "getServerMesh",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerMeshView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Mesh node of a server",
        "tags": [
          "servers",
          "mesh"
        ]
      },
      "put": {
        "description": "Enabling adds one tagged device to the team's tailnet (it may be billed by Tailscale) and needs `acceptMeshChanges`; with `?dryRun=true` it returns the plan instead (devices added, whether the host has /dev/net/tun, warnings and blockers). Disabling is refused (409 `mesh_server_in_use`) while replicas or cross-server links use the server's node. The node key is minted when the command is sent and never stored.",
        "operationId": "setServerMesh",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Return the plan (devices added, blockers, warnings) without changing anything",
            "explode": false,
            "in": "query",
            "name": "dryRun",
            "schema": {
              "description": "Return the plan (devices added, blockers, warnings) without changing anything",
              "type": "boolean"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetServerMeshInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerMeshResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Turn the mesh on or off for a server",
        "tags": [
          "servers",
          "mesh"
        ]
      }
    },
    "/servers/{serverId}/mesh/check": {
      "post": {
        "description": "The agent checks whether the server's node reaches the other servers' nodes (connected, refused, timeout, no_path). This is the ground truth for advisory ACL modes.",
        "operationId": "checkServerMesh",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CheckServerInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CheckServerOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Test the mesh connectivity of a server",
        "tags": [
          "servers",
          "mesh"
        ]
      }
    },
    "/servers/{serverId}/mesh/reprovision": {
      "post": {
        "description": "Deletes the node's device from the tailnet and re-creates it with a fresh single-use key and a fresh state volume. The node gets a new tailnet IP and the access rules regenerate. Use it when the node needs attention.",
        "operationId": "reprovisionServerMesh",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcceptedOutputBody"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Re-provision the mesh node of a server",
        "tags": [
          "servers",
          "mesh"
        ]
      }
    },
    "/servers/{serverId}/metrics": {
      "get": {
        "operationId": "getServerMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Time window; each response has at most 300 points",
            "explode": false,
            "in": "query",
            "name": "range",
            "schema": {
              "default": "1h",
              "description": "Time window; each response has at most 300 points",
              "enum": [
                "5m",
                "10m",
                "30m",
                "1h",
                "6h",
                "12h",
                "24h",
                "7d",
                "30d"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerMetricsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Host CPU, memory and disk over time",
        "tags": [
          "metrics"
        ]
      }
    },
    "/servers/{serverId}/patches": {
      "get": {
        "description": "The Updates panel: how many packages are waiting (and how many are security updates), whether the host asks for a reboot, the pending packages with a warning where an upgrade is risky, the production services that run on the server, and the recent runs. The agent checks every server about every 6 hours; `known` is false until the first check completes.",
        "operationId": "getServerPatches",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Pending OS updates and reboot-required of a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/patches/apply": {
      "post": {
        "description": "Runs `apt-get upgrade` or `dnf upgrade` (security updates only with `securityOnly`) on the host as root, keeping the configuration files you changed, then checks again. The upgrade runs detached on the host, so it finishes even when Docker restarts. Never reboots. Instance admin only; `confirm` must be the server's name; a server that runs production services or the control plane also needs `acknowledgeProduction` (422 `production_ack_required`), and a token that asks for production approvals gets 409 `approval_required`. Needs a completed check first (409 `no_check_yet`). Audited.",
        "operationId": "applyServerPatches",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ApplyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Upgrade the server's packages",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/patches/check": {
      "post": {
        "description": "Refreshes the package lists on the host and records the pending updates and reboot-required. Changes no package. Needs the Owner or Admin role. 409 `server_offline` when the server is offline, 409 `patching_running` while a run is in flight.",
        "operationId": "checkServerPatches",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Check the server for updates now",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/patches/plan": {
      "get": {
        "description": "The plan shown before the confirmation: the packages that would be upgraded, the risky ones among them and why, whether a reboot will probably be needed, whether Docker restarts, the production services on the server and what the apply request must carry (the server's name, and `acknowledgeProduction` when `requiresAcknowledgement`). Changes nothing.",
        "operationId": "planServerPatches",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Plan to upgrade only the packages with a security update",
            "explode": false,
            "in": "query",
            "name": "securityOnly",
            "schema": {
              "description": "Plan to upgrade only the packages with a security update",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "What an upgrade of the server would do",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/patches/reboot": {
      "post": {
        "description": "Schedules a reboot of the host a few seconds ahead. Every service on the server goes down until it boots and Docker starts them again. The run stays `rebooting` until the agent reconnects on a new boot (it fails after 20 minutes). Instance admin only; `confirm` must be the server's name; a server that runs production services or the control plane also needs `acknowledgeProduction`. Audited.",
        "operationId": "rebootServer",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RebootInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchRun"
                }
              }
            },
            "description": "Accepted"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Reboot the server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/patches/runs/{runId}": {
      "get": {
        "description": "The log is the tail of what the package manager printed. A run in `rebooting` waits for the agent to reconnect on a new boot.",
        "operationId": "getServerPatchRun",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "runId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PatchRun"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "One check, upgrade or reboot of a server, with the upgrade's log",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/ports": {
      "get": {
        "description": "Includes staged (not yet deployed) routes. Holder names of projects the caller cannot see are omitted.",
        "operationId": "listServerPorts",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PortsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "List the tcp/udp ports route services hold on a server",
        "tags": [
          "routes"
        ]
      }
    },
    "/servers/{serverId}/proxy": {
      "get": {
        "operationId": "getServerProxy",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerProxy"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Server-level proxy state: certificates, upstream policy, TCP/UDP ports and tailnet",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/proxy/deploy": {
      "post": {
        "description": "Sends a `proxy_configure` command with the desired certificates, upstream policy and tailnet. The result updates the applied state asynchronously.",
        "operationId": "deployServerProxy",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeployInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProxyDeployResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Deploy the server-level proxy configuration",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/proxy/plan": {
      "post": {
        "description": "Lists the staged differences, whether the proxy container is recreated and warnings (a tailnet node is created, replaced or deleted, a port another process holds, HTTP-01 certificates that cannot validate off port 80). `ports` plans the deploy as if that proxy ports setting were staged too, without staging it (0 = the agent's own port).",
        "operationId": "planServerProxy",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PlanInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProxyPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Preview what deploying the proxy would change",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/proxy/routes": {
      "get": {
        "description": "Hostnames, upstreams and policies as the proxy receives them. Basic-auth users and hashes are never included.",
        "operationId": "listServerProxyRoutes",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RoutesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "The effective route table of the server's proxy (read-only)",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/proxy/settings": {
      "patch": {
        "description": "Needs `proxy:write`; the loopback and link-local toggles need `admin`; the proxy `ports` can only be changed by the instance administrator (403 `instance_admin_required`; 422 `invalid_proxy_ports`, `proxy_port_clash`, `agent_too_old`). Changes are staged until `POST /servers/{id}/proxy/deploy`, which recreates the proxy container when a port changes. A managed tailnet needs the Tailscale integration (422 `tailnet_not_configured`); host mode needs Tailscale detected on the host (422 `host_tailscale_not_detected`).",
        "operationId": "updateServerProxySettings",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateSettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServerProxy"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Stage upstream policy and tailnet settings",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/proxy/tailnet/reprovision": {
      "post": {
        "description": "Deletes the node's state, registers it again with a fresh single-use key and removes the old device from the tailnet. Use it when the device was removed in the Tailscale admin console.",
        "operationId": "reprovisionServerTailnet",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProxyDeployResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "proxy:write"
            ]
          }
        ],
        "summary": "Re-provision the managed tailnet node",
        "tags": [
          "proxy"
        ]
      }
    },
    "/servers/{serverId}/revoke": {
      "post": {
        "description": "Revokes the agent identity and pending enrollment tokens, cancels commands that were never delivered (their deployments fail with \"Server revoked. No changes were made.\") and disconnects the agent. Containers already running on the host are left untouched.",
        "operationId": "revokeServer",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Server"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Revoke a server's agent",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/tunnel": {
      "delete": {
        "description": "Points the server's domains back at its public IP, removes the connector and deletes the tunnel at Cloudflare shortly afterwards. Disabling a tunnel that is already being removed retries the delete. Ports 80 and 443 must be reachable again before the DNS change propagates.",
        "operationId": "disableServerTunnel",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Drop the tunnel record without asking Cloudflare (it may linger in the Cloudflare dashboard). Use it when the Cloudflare connection is gone or Cloudflare keeps refusing the delete.",
            "explode": false,
            "in": "query",
            "name": "force",
            "schema": {
              "description": "Drop the tunnel record without asking Cloudflare (it may linger in the Cloudflare dashboard). Use it when the Cloudflare connection is gone or Cloudflare keeps refusing the delete.",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TunnelView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Disable the Cloudflare Tunnel of a server",
        "tags": [
          "servers"
        ]
      },
      "get": {
        "description": "Whether the server has a Cloudflare Tunnel, the connector's observed state and the ingress sync. A server without a tunnel answers `state: off` and says whether one can be enabled.",
        "operationId": "getServerTunnel",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TunnelView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "Cloudflare Tunnel state of a server",
        "tags": [
          "servers"
        ]
      },
      "post": {
        "description": "Creates a remotely-managed tunnel with the team's Cloudflare connection, pushes its ingress rules (every hostname of the server's services to the proxy, then a 404 catch-all) and tells the agent to run the cloudflared connector. The connector token is fetched when the command is sent and is never stored. Once the connector connects, the server's domains in connected zones point at the tunnel and ports 80 and 443 may stay closed. Needs the `servers:write` and `proxy:write` scopes. The Cloudflare token needs the permission Account, Cloudflare Tunnel, Edit (422 `cloudflare_tunnel_forbidden`).",
        "operationId": "enableServerTunnel",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TunnelView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Enable a Cloudflare Tunnel on a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/tunnel/sync": {
      "post": {
        "description": "Re-pushes the ingress rules and re-sends the connector command (creating the container again when it is gone). Use it when the connector needs attention.",
        "operationId": "resyncServerTunnel",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TunnelView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Re-sync the Cloudflare Tunnel of a server",
        "tags": [
          "servers"
        ]
      }
    },
    "/servers/{serverId}/undrain": {
      "post": {
        "description": "Clears the drain state of a drained or failed-drain server. Services that were moved stay where they are.",
        "operationId": "undrainServer",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Server"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write"
            ]
          },
          {
            "cookie": [
              "servers:write"
            ]
          }
        ],
        "summary": "Make a drained server schedulable again",
        "tags": [
          "fleet"
        ]
      }
    },
    "/servers/{serverId}/unrestricted": {
      "get": {
        "operationId": "getServerUnrestricted",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UnrestrictedSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:read"
            ]
          },
          {
            "cookie": [
              "servers:read"
            ]
          }
        ],
        "summary": "The Unrestricted switch and Compose availability of a server",
        "tags": [
          "servers"
        ]
      },
      "put": {
        "description": "By default Compose stacks and services run under safe allow-lists: no privileged mode, host network, host PID namespace, devices, GPUs, custom runtime, unconfined seccomp or AppArmor, NET_ADMIN or SYS_ADMIN, Docker socket or host bind mounts. An unrestricted server lifts them for everything on it, so anyone who can deploy there can take over the server. Instance admin only; enabling needs `confirm` to equal the server's name. Audited as `server.unrestricted.enable` or `.disable`. Disabling does not touch running containers: the next deploy, rollback or reconcile of a stack or service that needs the lifted rules fails until it is edited or moved.",
        "operationId": "setServerUnrestricted",
        "parameters": [
          {
            "in": "path",
            "name": "serverId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetUnrestrictedInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UnrestrictedSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "servers:write",
              "admin"
            ]
          },
          {
            "cookie": [
              "servers:write",
              "admin"
            ]
          }
        ],
        "summary": "Make a server unrestricted, or restricted again",
        "tags": [
          "servers"
        ]
      }
    },
    "/services/{serviceId}": {
      "delete": {
        "description": "Requires `confirm=\u003cslug\u003e`. A deployed service's container is removed from its server; volumes are kept unless `deleteVolumes=true`.",
        "operationId": "deleteService",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Must equal the service slug",
            "explode": false,
            "in": "query",
            "name": "confirm",
            "schema": {
              "description": "Must equal the service slug",
              "type": "string"
            }
          },
          {
            "description": "Also remove the service's Docker volumes (data is lost)",
            "explode": false,
            "in": "query",
            "name": "deleteVolumes",
            "schema": {
              "description": "Also remove the service's Docker volumes (data is lost)",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a service",
        "tags": [
          "services"
        ]
      },
      "get": {
        "operationId": "getService",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a service",
        "tags": [
          "services"
        ]
      },
      "patch": {
        "description": "Requires `If-Match: \"\u003cgeneration\u003e\"`. A stale value returns 412 `generation_conflict`. Every effective change increments the generation; the change takes effect on the next deployment.",
        "operationId": "updateService",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The ETag (generation) from the last GET, e.g. \"3\". Required.",
            "in": "header",
            "name": "If-Match",
            "schema": {
              "description": "The ETag (generation) from the last GET, e.g. \"3\". Required.",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "412": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Failed"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "428": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Required"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update a service's configuration (staged until deployed)",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/analytics": {
      "get": {
        "description": "Aggregated from Traefik access logs on the service's server: requests, bandwidth, unique visitors (per UTC day, bots excluded), latency percentiles from merged histograms, status codes and top lists. Raw access logs, IPs and user agents are never stored. Window to report. Minute data covers 24 hours; longer ranges read hourly (default 7 days kept) or daily (90 days) rows.",
        "operationId": "getServiceAnalytics",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Window to report",
            "explode": false,
            "in": "query",
            "name": "range",
            "schema": {
              "default": "24h",
              "description": "Window to report",
              "enum": [
                "5m",
                "10m",
                "15m",
                "30m",
                "1h",
                "6h",
                "12h",
                "24h",
                "7d",
                "30d",
                "90d"
              ],
              "type": "string"
            }
          },
          {
            "description": "prev adds the previous equal window as comparison",
            "explode": false,
            "in": "query",
            "name": "compare",
            "schema": {
              "description": "prev adds the previous equal window as comparison",
              "enum": [
                "",
                "prev"
              ],
              "type": "string"
            }
          },
          {
            "description": "Restrict to one hostname of the service",
            "explode": false,
            "in": "query",
            "name": "host",
            "schema": {
              "description": "Restrict to one hostname of the service",
              "maxLength": 253,
              "type": "string"
            }
          },
          {
            "description": "true (default) ranks top paths by page views (documents); false ranks every request",
            "explode": false,
            "in": "query",
            "name": "pages",
            "schema": {
              "default": true,
              "description": "true (default) ranks top paths by page views (documents); false ranks every request",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Report"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Traffic analytics of a service",
        "tags": [
          "analytics"
        ]
      }
    },
    "/services/{serviceId}/backup-restores": {
      "get": {
        "operationId": "listBackupRestores",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RestoreListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List restores of a database",
        "tags": [
          "backups"
        ]
      }
    },
    "/services/{serviceId}/backup-schedules": {
      "get": {
        "operationId": "listBackupSchedules",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ScheduleListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a database's backup schedules",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "operationId": "createBackupSchedule",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateScheduleInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ScheduleView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Schedule recurring backups",
        "tags": [
          "backups"
        ]
      }
    },
    "/services/{serviceId}/backups": {
      "get": {
        "operationId": "listBackups",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 0,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a database's backups",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "Returns 202 with a queued backup; poll it or listen for `backup.updated` events. 409 `server_offline` / `database_not_running` when it can not start.",
        "operationId": "createBackup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BackupView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Back up a database now",
        "tags": [
          "backups"
        ]
      }
    },
    "/services/{serviceId}/build-plan": {
      "post": {
        "description": "Asks the agent of the service's server to clone the branch head and report the build method (the repository's Dockerfile, Railpack or a generated starter Dockerfile), why it applies, and for Railpack the detected providers, packages, steps and start command. Nothing is built or deployed. The request waits for the agent (up to 150 s): 409 `server_offline` when the server is offline, 504 `build_plan_timeout` when it does not answer. Requires `deployments:write` because it makes the server clone the repository and run the planner.",
        "operationId": "previewBuildPlan",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BuildPlanResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Preview how a git service would be built",
        "tags": [
          "deployments"
        ]
      }
    },
    "/services/{serviceId}/clone": {
      "post": {
        "description": "Creates a staged copy of a service in the same or another environment of the team; nothing runs until it is deployed. The clone gets the source's configuration (Docker options included), variables, volume definitions and, in the same environment, its outgoing links. Secrets are copied sealed and generated values are generated again. Volumes are new and empty (the data is not copied). A managed database is created new and empty with new credentials: restore a dump into it. Domains are dropped (default) or cloned with a suffix; 409 `domain_conflict` when a suffixed hostname is taken. Needs write access to the source and the target environment. Route services, Compose stacks and read replicas are not cloned (422 `not_applicable`). `dryRun` returns the plan and changes nothing; the response lists variable references that do not resolve in the target environment.",
        "operationId": "cloneService",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CloneServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CloneResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Clone a service",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/database": {
      "get": {
        "operationId": "getDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DatabaseView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a managed database's engine, exports and state",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/promote": {
      "post": {
        "description": "Called on the replica. Manual: NebulaCtrl does not detect failures or switch automatically. With `dryRun` the plan is returned (status 200): `switchover` while the old primary is reachable (it is frozen, stopped and fenced, the replica replays everything, no data is lost) or `forced` otherwise (it needs `acceptDataLoss`: what the replica had not received is lost). The old primary is fenced and never runs as a primary again; rebuild it as a replica or delete it. Variables that reference the old primary are rewritten as staged changes. Production environments need approval. Asynchronous: poll `replication.promotion`.",
        "operationId": "promoteDatabaseReplica",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PromoteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PromoteResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Promote a read replica to primary (manual)",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/public-port": {
      "delete": {
        "description": "Deletes the route service. A deployed route disappears from the server's table at once.",
        "operationId": "disableDatabasePublicPort",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicPortView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Close a database's public port",
        "tags": [
          "databases"
        ]
      },
      "get": {
        "operationId": "getDatabasePublicPort",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicPortView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a database's public port",
        "tags": [
          "databases"
        ]
      },
      "put": {
        "description": "Stages a TCP route on `listenPort` of the database's server with a mandatory IP allow-list and an optional deny list (deny first). `0.0.0.0/0` or `::/0` is accepted only with `confirmOpen` set to the database slug. The proxy forwards raw TCP and never terminates TLS. Nothing changes until the route is deployed; a new port recreates the proxy container (about a second of dropped connections). Needs `projects:write` and `proxy:write`. 422 codes: `allowlist_required`, `open_confirmation_required`, `invalid_config`, `invalid_listen_port`, `no_server`, `agent_too_old`. 409 `port_in_use`.",
        "operationId": "setDatabasePublicPort",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetPublicPortInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicPortView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "proxy:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "proxy:write"
            ]
          }
        ],
        "summary": "Publish (or change) a database's public port",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/public-port/connection": {
      "post": {
        "description": "Like `revealDatabaseExport`, but with the server's public IP and the public port instead of the private host. Needs `deployments:write`, is uncached and recorded as `secret.reveal`. 409 `public_port_disabled`; 422 `no_public_address` when the server has no public IP.",
        "operationId": "revealDatabasePublicConnection",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PublicConnectionInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PublicConnection"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "Pragma": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Reveal the external connection string (audited)",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/rebuild": {
      "post": {
        "description": "Clones the primary again into a new data volume (the old volume is kept until it is deleted). On a fenced old primary the body may name the new primary to follow. Asynchronous.",
        "operationId": "rebuildDatabaseReplica",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RebuildInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RebuildResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Rebuild a replica, or a fenced old primary as a replica",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/refresh": {
      "post": {
        "description": "Asynchronous: poll `GET /services/{id}/database` (or watch the event feed) for the new `info`.",
        "operationId": "refreshDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RefreshResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:read",
              "deployments:write"
            ]
          }
        ],
        "summary": "Ask the agent for the database's version, size and connections",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/replica": {
      "delete": {
        "description": "Called on the replica. Deletes its container and data volume, drops its slot, role and pg_hba.conf line on the primary and releases its mesh link. Asynchronous.",
        "operationId": "removeDatabaseReplica",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RemoveResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Remove a read replica",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/replicas": {
      "post": {
        "description": "Creates a read replica service in the primary's environment and clones the primary into it. The replica runs on the primary's server or, with the server mesh enabled on both, on another server. Asynchronous: the replica is `pending`, then `preparing`, `cloning`, `deploying` and `streaming`; follow it with `GET /services/{id}/database/replication`. With `dryRun` only the plan is returned (status 200). Replication is asynchronous and manual: nothing is detected or switched automatically.",
        "operationId": "addDatabaseReplica",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AddReplicaInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AddReplicaResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Add a read replica of a PostgreSQL primary",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/replication": {
      "get": {
        "operationId": "getDatabaseReplication",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReplicationView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get the read replica group of a PostgreSQL database",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/reveal": {
      "post": {
        "description": "Returns one derived export such as `DATABASE_URL` in plain text, uncached. Requires the `deployments:write` scope (or admin) and is recorded in the audit log as `secret.reveal`. Every other read stays masked.",
        "operationId": "revealDatabaseExport",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RevealInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Revealed"
                }
              }
            },
            "description": "OK",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string"
                }
              },
              "Pragma": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Reveal a connection string (audited)",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/rotate-credentials": {
      "post": {
        "description": "Changes the application password inside the running database through the agent (or, for Valkey and Redis, stages a new password), updates the variable and stages every service that references the database. Nothing is deployed. With `dryRun` only the plan is returned.",
        "operationId": "rotateDatabaseCredentials",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RotationResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Rotate the database password",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/upgrade": {
      "post": {
        "description": "In-place engines stage the new image. PostgreSQL majors are converted with pg_upgrade into a new volume (the old volume is kept) and the new version is staged when the conversion finishes. Take a backup first.",
        "operationId": "upgradeDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpgradeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpgradeResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:write",
              "deployments:write"
            ]
          }
        ],
        "summary": "Upgrade the database version",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/database/upgrade/plan": {
      "post": {
        "operationId": "planDatabaseUpgrade",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpgradePlanInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpgradePlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Plan a version upgrade",
        "tags": [
          "databases"
        ]
      }
    },
    "/services/{serviceId}/deploy-hook": {
      "get": {
        "description": "Whether the hook is on, when its secret was created, and what the last call did. The secret and the URL are never returned here; `urlPattern` shows the URL with a placeholder.",
        "operationId": "getDeployHook",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeployHookView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a service's deploy hook",
        "tags": [
          "services",
          "deploy-hooks"
        ]
      },
      "put": {
        "description": "Turning the hook on creates a secret (at least 256 bits, stored only as a hash) and returns the complete `url` once; `POST /hooks/deploy/\u003cserviceId\u003e/\u003csecret\u003e` then deploys the service like a manual deploy, with trigger `deploy_hook`. Turning it off deletes the secret, so enabling again gives a new URL. Needs `deployments:write`.",
        "operationId": "setDeployHook",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeployHookSetting"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeployHookView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Turn a service's deploy hook on or off",
        "tags": [
          "services",
          "deploy-hooks"
        ]
      }
    },
    "/services/{serviceId}/deploy-hook/rotate": {
      "post": {
        "description": "Replaces the secret of an enabled hook; the old URL stops working at once. The new `url` is returned once. 409 `deploy_hook_disabled` when the hook is off. Needs `deployments:write`.",
        "operationId": "rotateDeployHook",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeployHookView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Rotate a service's deploy hook secret",
        "tags": [
          "services",
          "deploy-hooks"
        ]
      }
    },
    "/services/{serviceId}/deployments": {
      "get": {
        "operationId": "listDeployments",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 50, max 200)",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "description": "Page size (default 50, max 200)",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PageDeploymentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's deployments (newest first)",
        "tags": [
          "deployments"
        ]
      },
      "post": {
        "description": "Returns 202 with the deployment; it runs asynchronously. 409 `deployment_in_progress` while another deployment of the service is active; 422 for blocking problems (no server, revoked server, unresolved variable references).",
        "operationId": "deployService",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DeployInputBody1"
              }
            }
          }
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DeploymentView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Deploy a service",
        "tags": [
          "deployments"
        ]
      }
    },
    "/services/{serviceId}/deployments/plan": {
      "post": {
        "description": "Reports the strategy (rolling or recreate, with reasons), warnings, the pending changes, the resolved source and blocking problems. Nothing is started.",
        "operationId": "planDeployment",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Plan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Plan a deployment (dry run)",
        "tags": [
          "deployments"
        ]
      }
    },
    "/services/{serviceId}/domains": {
      "get": {
        "operationId": "listDomains",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListOutputBody1"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's domains",
        "tags": [
          "domains"
        ]
      },
      "post": {
        "description": "Hostnames are RFC 1123, lowercase and globally unique (409 `domain_conflict`). Fails with 422 `proxy_unavailable` while the server's proxy is not running. `statusMessage` carries DNS guidance and `dnsOk` the result of the periodic DNS check. Compose stacks need `component` (422 `component_required`, `unknown_component`) and, unless the component declares exactly one port, `targetPort` (422 `target_port_required`).",
        "operationId": "createDomain",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateInputBody1"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DomainView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Add a domain (staged until deployed)",
        "tags": [
          "domains"
        ]
      }
    },
    "/services/{serviceId}/domains/generate": {
      "post": {
        "description": "Creates `\u003cservice\u003e-\u003cenv\u003e-\u003cproject\u003e.\u003cbase\u003e` where base is the server's base domain, else `\u003cpublic-ip\u003e.sslip.io`. 422 `no_base_domain` when neither exists. Compose stacks need `component`; the hostname is `\u003cservice\u003e-\u003ccomponent\u003e-\u003cenv\u003e-\u003cproject\u003e.\u003cbase\u003e`.",
        "operationId": "generateDomain",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Compose stacks only (required for them): the component the generated domain routes to",
            "explode": false,
            "in": "query",
            "name": "component",
            "schema": {
              "description": "Compose stacks only (required for them): the component the generated domain routes to",
              "type": "string"
            }
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DomainView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Generate a domain",
        "tags": [
          "domains"
        ]
      }
    },
    "/services/{serviceId}/dump-restores": {
      "get": {
        "operationId": "listDumpRestores",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DumpRestoreListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List restores from a dump file of a database",
        "tags": [
          "backups"
        ]
      },
      "post": {
        "description": "Prepares a restore of a managed database from a file you upload: a `pg_dump` file (custom `-Fc`, tar `-Ft` or plain SQL, optionally gzipped), a `mysqldump`/`mariadb-dump` SQL file (optionally gzipped) or a `mongodump --archive` file. mode `new` (default) creates a sibling database and deploys it empty; mode `in_place` first takes a safety backup (needs `confirmSlug`) and then replaces this database's data. Poll the restore until its status is `awaiting_upload`, then send the file: `PUT /api/v1/dump-restores/{restoreId}/upload` with the file as the raw request body (`Content-Type: application/octet-stream`, `Content-Length` required, optional `?fileName=`). It answers 202 once the agent has the whole file (status `restoring`); poll `GET /dump-restores/{restoreId}` for `succeeded` or `failed`. The control plane stores nothing: the bytes stream through it to the agent. The format is detected from the file's first bytes (422 `unsupported_dump_format` when it does not fit the engine); 413 `file_too_large` above the limit (`maxUploadBytes`, default 5 GiB).",
        "operationId": "createDumpRestore",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateDumpRestoreInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DumpRestoreView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "413": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Request Entity Too Large"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write",
              "projects:write"
            ]
          },
          {
            "cookie": [
              "deployments:write",
              "projects:write"
            ]
          }
        ],
        "summary": "Restore a database from a dump file",
        "tags": [
          "backups"
        ]
      }
    },
    "/services/{serviceId}/env-template-scan": {
      "post": {
        "description": "Reads `.env.example`, `.env.sample`, `.env.template` and `.env.dist` (never `.env` or `.env.local`) from the repository root and the build context at the tracked branch: through the git provider's API when the service is linked to a connection or the repository is public on github.com or gitlab.com, otherwise by a scan-only command on the service's server. The files become the suggestion source of `GET /services/{serviceId}/suggested-variables`. Returns the keys not set yet with smart defaults; a repository that cannot be read answers `status: unavailable` with the reason, and nothing changes. Reading re-runs on every push to the tracked branch.",
        "operationId": "scanServiceEnvTemplates",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnvTemplateScan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Read a git service's .env.example files again",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/files": {
      "get": {
        "description": "Lists the immediate children of an absolute path (directories first, at most 2000 entries). The listing reads the container's own filesystem through the Docker API; nothing on the host is reachable. Requires the Owner, Admin or Developer role.",
        "operationId": "listServiceFiles",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Replica index.",
            "explode": false,
            "in": "query",
            "name": "replica",
            "schema": {
              "default": 0,
              "description": "Replica index.",
              "format": "int64",
              "maximum": 999,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "description": "Absolute directory path inside the container.",
            "explode": false,
            "in": "query",
            "name": "path",
            "schema": {
              "default": "/",
              "description": "Absolute directory path inside the container.",
              "maxLength": 4096,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/FileListing"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:read",
              "deployments:write"
            ]
          }
        ],
        "summary": "List a directory inside a replica container",
        "tags": [
          "terminal"
        ]
      }
    },
    "/services/{serviceId}/git": {
      "delete": {
        "description": "Stops auto-deploy. The clone URL and branch stay in the service's config.",
        "operationId": "unlinkServiceGit",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Unlink a service from its repository",
        "tags": [
          "services",
          "git"
        ]
      },
      "get": {
        "description": "`linked: false` when the service has no link.",
        "operationId": "getServiceGit",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GitLinkView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a service's repository link",
        "tags": [
          "services",
          "git"
        ]
      },
      "put": {
        "description": "Points the service's clone URL and branch at the repository (a staged change when they differ) and stores the auto-deploy settings, which are operational: they are applied immediately, never staged and never rolled back. A push to the branch deploys the service (trigger `git_push`) when a changed file matches the watch paths; a push during a running deployment is queued and the newest one deploys next. Webhooks are registered for GitLab, Gitea and Forgejo; GitHub uses the App's webhook and Bitbucket a webhook you create (see the connection). The `webhook` field reports the state.",
        "operationId": "linkServiceGit",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LinkInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GitLinkView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "412": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Precondition Failed"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Link a service to a repository and set auto-deploy",
        "tags": [
          "services",
          "git"
        ]
      }
    },
    "/services/{serviceId}/incidents": {
      "get": {
        "description": "Stretches of time in which the service crashed, was unhealthy or restart-looped, newest first. An open incident has no resolvedAt.",
        "operationId": "listServiceIncidents",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Default 50.",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "description": "Default 50.",
              "format": "int64",
              "maximum": 200,
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListIncidentsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's health incidents",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/logs": {
      "get": {
        "description": "Without `follow` returns `{items:[{ts,line}]}`. With `follow=true` streams server-sent events `data: {ts,line,serviceId}`. Secret values are redacted. 503 `server_offline` when the server is not connected.",
        "operationId": "getServiceLogs",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "tail",
            "schema": {
              "default": 200,
              "format": "int64",
              "maximum": 5000,
              "minimum": 0,
              "type": "integer"
            }
          },
          {
            "description": "Stream new lines as server-sent events",
            "explode": false,
            "in": "query",
            "name": "follow",
            "schema": {
              "description": "Stream new lines as server-sent events",
              "type": "boolean"
            }
          },
          {
            "description": "Compose stacks only: show one component's lines (without it, every component, each line prefixed '\u003ccomponent\u003e | ')",
            "explode": false,
            "in": "query",
            "name": "component",
            "schema": {
              "description": "Compose stacks only: show one component's lines (without it, every component, each line prefixed '\u003ccomponent\u003e | ')",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              },
              "text/event-stream": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "JSON `{items}` without `follow`; a `text/event-stream` with `follow=true`"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Runtime logs of a service",
        "tags": [
          "logs"
        ]
      }
    },
    "/services/{serviceId}/logs/download": {
      "get": {
        "description": "The service's runtime log from the server's own history (7 days by default) as `format=txt` (default; one `\u003ctime\u003e \u003cline\u003e` per line) or `format=ndjson` (`{ts, stream, replica, deploymentId, line}` per line), oldest first, within an optional `from`/`to` range and `q` filter. Secret values are redacted exactly as in the log view. At most 200,000 lines: a longer range ends with a truncation note, so narrow it. The history comes from the server's agent: 503 `server_offline` while it is offline, 409 `history_disabled` when capture is off. Audited as `service.logs.download`.",
        "operationId": "downloadServiceLogs",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Compose stacks only: only the lines of this component.",
            "explode": false,
            "in": "query",
            "name": "component",
            "schema": {
              "description": "Compose stacks only: only the lines of this component.",
              "type": "string"
            }
          },
          {
            "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Only lines before this time (RFC 3339). Default: now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Only lines before this time (RFC 3339). Default: now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "A log search query (the same language as the log views).",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "A log search query (the same language as the log views).",
              "maxLength": 2000,
              "type": "string"
            }
          },
          {
            "description": "txt (default) or ndjson.",
            "explode": false,
            "in": "query",
            "name": "format",
            "schema": {
              "default": "txt",
              "description": "txt (default) or ndjson.",
              "enum": [
                "txt",
                "ndjson"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/x-ndjson": {
                "schema": {
                  "type": "string"
                }
              },
              "text/plain": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note."
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Download a service's stored runtime logs as a file",
        "tags": [
          "logs"
        ]
      }
    },
    "/services/{serviceId}/logs/history": {
      "get": {
        "description": "A page of the service's runtime log from the server's own history (7 days by default), within an optional time range, filtered by the log search language. The server's agent answers, so history is unavailable (503 `server_offline`) while the server is offline. Secret values are redacted. Page with `nextCursor`; `partial: true` means the scan stopped early and the cursor continues it.",
        "operationId": "getServiceLogHistory",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Compose stacks only: only the lines of this component (stored lines keep the '\u003ccomponent\u003e | ' prefix the agent adds).",
            "explode": false,
            "in": "query",
            "name": "component",
            "schema": {
              "description": "Compose stacks only: only the lines of this component (stored lines keep the '\u003ccomponent\u003e | ' prefix the agent adds).",
              "type": "string"
            }
          },
          {
            "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
            "explode": false,
            "in": "query",
            "name": "from",
            "schema": {
              "description": "Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "Only lines before this time (RFC 3339). Default: now.",
            "explode": false,
            "in": "query",
            "name": "to",
            "schema": {
              "description": "Only lines before this time (RFC 3339). Default: now.",
              "format": "date-time",
              "type": "string"
            }
          },
          {
            "description": "A log search query (the same language as the log views): free text, \"phrases\", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.",
            "explode": false,
            "in": "query",
            "name": "q",
            "schema": {
              "description": "A log search query (the same language as the log views): free text, \"phrases\", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.",
              "type": "string"
            }
          },
          {
            "description": "Page size (default 500, max 2000).",
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "description": "Page size (default 500, max 2000).",
              "format": "int64",
              "maximum": 2000,
              "minimum": 1,
              "type": "integer"
            }
          },
          {
            "description": "Opaque cursor from a previous page's nextCursor.",
            "explode": false,
            "in": "query",
            "name": "cursor",
            "schema": {
              "description": "Opaque cursor from a previous page's nextCursor.",
              "type": "string"
            }
          },
          {
            "description": "desc (default): newest first. asc: oldest first.",
            "explode": false,
            "in": "query",
            "name": "order",
            "schema": {
              "description": "desc (default): newest first. asc: oldest first.",
              "enum": [
                "desc",
                "asc"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LogHistoryPage"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Service Unavailable"
          },
          "504": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Gateway Timeout"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Stored runtime logs of a service",
        "tags": [
          "logs"
        ]
      }
    },
    "/services/{serviceId}/maintenance": {
      "put": {
        "description": "While enabled, the proxy answers every domain of the service with HTTP 503, a `Retry-After` header and the maintenance page (the same animated page as the automatic error pages), instead of reaching the service. It takes effect immediately, without a deployment, and keeps working through deployments of the service. It is an operational setting: never staged and never rolled back. A deployed service's server is sent the new route table; an undeployed service applies the setting with its first deployment. Idempotent: repeating the same request changes nothing. Switching off keeps the stored text for the next time. tcp/udp route services cannot be put into maintenance (422 `maintenance_unsupported`).",
        "operationId": "setServiceMaintenance",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetMaintenanceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Switch a service's maintenance mode",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/maintenance/preview": {
      "get": {
        "description": "Returns the self-contained HTML page exactly as the proxy serves it (status 200 here; the proxy answers 503). Optional query parameters preview unsaved text.",
        "operationId": "previewServiceMaintenance",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Preview the title, message and eta below instead of the stored ones (empty values show the defaults)",
            "explode": false,
            "in": "query",
            "name": "draft",
            "schema": {
              "description": "Preview the title, message and eta below instead of the stored ones (empty values show the defaults)",
              "type": "boolean"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "title",
            "schema": {
              "maxLength": 80,
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "message",
            "schema": {
              "maxLength": 600,
              "type": "string"
            }
          },
          {
            "description": "RFC 3339 time",
            "explode": false,
            "in": "query",
            "name": "eta",
            "schema": {
              "description": "RFC 3339 time",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "text/html": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "The maintenance page"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Preview a service's maintenance page",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/mesh": {
      "get": {
        "description": "Needs `projects:read`. `exposures` are the service's ports on its server's mesh node, `routes` the providers on other servers it reaches (a consumer dials `\u003cprovider slug\u003e:\u003cmesh port\u003e`), `consumers` the services on other servers that reach it.",
        "operationId": "getServiceMesh",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceMeshView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Mesh exposures, routes and consumers of a service",
        "tags": [
          "mesh"
        ]
      }
    },
    "/services/{serviceId}/metrics": {
      "get": {
        "description": "At most 300 points of `stepSeconds` each. `range` is one of 5m, 10m, 30m, 1h (default), 6h, 12h, 24h, 7d, 30d; longer ranges read downsampled tiers and carry the per-bucket peaks `cpuMax`/`memMax`. Memory is usage minus inactive file cache. `retentionDays` is how long the service's server keeps history.",
        "operationId": "getServiceMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "range",
            "schema": {
              "default": "1h",
              "enum": [
                "5m",
                "10m",
                "30m",
                "1h",
                "6h",
                "12h",
                "24h",
                "7d",
                "30d"
              ],
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MetricsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "CPU and memory of a service's container",
        "tags": [
          "metrics"
        ]
      }
    },
    "/services/{serviceId}/move": {
      "post": {
        "description": "Stages a move of the service to another environment (of any project of the team): it keeps running where it is until its next deployment, which joins the new environment's network and resolves its variables there. Domains, volumes and data stay with the service. References are checked first: variables of the service that point at services staying behind, and variables of other services that point at the moved one, break. The move is refused with 409 `move_blocked` (details.plan) unless `force` is set; links on the canvas are removed, and the services that referenced the moved one are marked as having staged changes. A service in a replica group or with a cross-server link cannot be moved (409 `move_blocked`); route services and Compose stacks are not movable (422 `not_applicable`). `dryRun` returns the plan and changes nothing. Moving a service out of or into a production environment needs approval for guarded clients.",
        "operationId": "moveService",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MoveServiceInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MoveResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Move a service to another environment",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/networks/{networkId}": {
      "delete": {
        "description": "Needs `deployments:write`. Advances the service generation; the next deployment leaves the network.",
        "operationId": "detachServiceNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "networkId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Detach a service from a shared network (staged)",
        "tags": [
          "networks"
        ]
      },
      "put": {
        "description": "Needs `deployments:write`. Advances the service generation; the next deployment joins the network. 422 `network_wrong_server` when the service is on another server than the network, 422 `egress_blocked` while the service blocks outbound internet.",
        "operationId": "attachServiceNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "networkId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/NetworkRef"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Attach a service to a shared network (staged)",
        "tags": [
          "networks"
        ]
      }
    },
    "/services/{serviceId}/pending-changes": {
      "get": {
        "description": "Field-level differences between the service's configuration and its current release. Secret values are masked.",
        "operationId": "listPendingChanges",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ChangesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Staged changes not yet deployed",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/pending-changes/{field}": {
      "delete": {
        "description": "Reverts a single field listed by pending-changes (`config.\u003cpath\u003e`, `server`, `variables.\u003cKEY\u003e`, `domains.\u003chost\u003e`, `volumes.\u003cname\u003e`) to the state of the current release and advances the generation. 404 when the field is not pending. Returns the updated service.",
        "operationId": "discardPendingChange",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "A pending-changes field: config.\u003cpath\u003e, server, variables.\u003cKEY\u003e, domains.\u003chost\u003e or volumes.\u003cname\u003e",
            "in": "path",
            "name": "field",
            "required": true,
            "schema": {
              "description": "A pending-changes field: config.\u003cpath\u003e, server, variables.\u003cKEY\u003e, domains.\u003chost\u003e or volumes.\u003cname\u003e",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Discard one staged change",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/restart": {
      "post": {
        "description": "Queues a restart on the service's server. It completes when the agent acknowledges it.",
        "operationId": "restartService",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ActionResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Restart the running container",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/retired-volumes": {
      "get": {
        "description": "Retired volumes are unmounted but kept on the server (their data is the rollback path of a restore) until deleted.",
        "operationId": "listRetiredVolumes",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RetiredVolumeListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the Docker volumes a restore swapped out",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/services/{serviceId}/run": {
      "post": {
        "description": "Runs the command (argv, no shell) in a throwaway container of the service's current image with its environment, on the service's server, with the service's resource limits and a timeout (default 30 minutes). Requires `deployments:write`; audited. Returns 202 with the queued run; follow the output through `GET /task-runs/{runId}/logs?follow=true`.",
        "operationId": "runServiceCommand",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RunCommandInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RunView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Run a one-off command",
        "tags": [
          "tasks"
        ]
      }
    },
    "/services/{serviceId}/scaling": {
      "put": {
        "description": "Runs the service on N replicas on its server (1-10) and/or turns CPU autoscaling on. Only stateless services qualify: no volumes, an HTTP port and kind other than database (422 `replicas_require_stateless`). A manual `replicas` value while autoscaling is enabled returns 409 `autoscaling_enabled`. The change applies immediately, without a deployment and without rebuilding: a deployed service is scaled through the agent, an undeployed one only stores the setting. It is never a staged change.",
        "operationId": "setServiceScaling",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetScalingInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceView"
                }
              }
            },
            "description": "OK",
            "headers": {
              "ETag": {
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Set a service's replica count and autoscaling",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/ssh": {
      "get": {
        "description": "The public key and fingerprint, the provider's \"add deploy key\" link when the host is a known public instance, and each pinned host key (with the refused key when the host's key changed). The private key is never returned. 422 `not_git_source`.",
        "operationId": "getServiceSshKey",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StatusView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a git service's SSH deploy key and pinned host keys",
        "tags": [
          "git"
        ]
      }
    },
    "/services/{serviceId}/ssh/host-keys/accept": {
      "post": {
        "description": "Replaces the pinned host key of the service's git host after you reviewed the fingerprint of the refused key. 409 `host_key_changed` when the server presents yet another key, 502 `host_unreachable` when it cannot be reached. Needs `projects:write`.",
        "operationId": "acceptServiceSshHostKey",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AcceptInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StatusView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Accept the SSH host key the git host presents now",
        "tags": [
          "git"
        ]
      }
    },
    "/services/{serviceId}/ssh/key": {
      "delete": {
        "description": "Needs `projects:write`. A service whose git URL is an SSH URL cannot be deployed until a key is set again.",
        "operationId": "deleteServiceSshKey",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Remove the SSH deploy key and the pinned host keys",
        "tags": [
          "git"
        ]
      },
      "post": {
        "description": "Without `privateKey` an Ed25519 key pair is generated; the public key goes on the repository as a deploy key. With `privateKey` your own unencrypted key is stored (write-only). An existing key is replaced only with `rotate: true`; otherwise 409 `ssh_key_exists`. Needs `projects:write`. Takes effect on the next deployment; nothing is staged.",
        "operationId": "setServiceSshKey",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetKeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/StatusView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Generate, upload or rotate the SSH deploy key",
        "tags": [
          "git"
        ]
      }
    },
    "/services/{serviceId}/ssh/test": {
      "post": {
        "description": "Fetches the configured branch over SSH with the deploy key. The first connection pins the host key; a changed key is refused and recorded. Always 200: `ok` and `code` (`no_key`, `not_ssh_url`, `host_key_changed`, `git_unreachable`) say what happened. Needs `projects:write`.",
        "operationId": "testServiceSshConnection",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TestResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Test the SSH connection to the repository",
        "tags": [
          "git"
        ]
      }
    },
    "/services/{serviceId}/stop": {
      "post": {
        "operationId": "stopService",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ActionResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Stop the running container",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/suggested-variables": {
      "get": {
        "description": "References to databases of the environment that nothing references yet, and the keys of the repository's `.env.example`-style files that are not set yet (read before the first deploy, see `POST /services/{serviceId}/env-template-scan`, and again after every push to the tracked branch and at every build). Accepting a suggestion is a normal staged write; send `source: \"suggested\"` for an `.env.example` key so a value left empty is reported by the deploy plan.",
        "operationId": "listSuggestedVariables",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuggestedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Suggested variables",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/tailnet/reprovision": {
      "post": {
        "description": "Deletes the service's device from the tailnet and re-creates it with a fresh single-use key and a fresh state volume. Use it when the node needs attention (the device was removed in the admin console or its key was rejected). The device gets a new tailnet IP.",
        "operationId": "reprovisionServiceTailnet",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReprovisionResult"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Re-provision the service's tailnet node",
        "tags": [
          "services"
        ]
      }
    },
    "/services/{serviceId}/task-runs": {
      "get": {
        "operationId": "listServiceTaskRuns",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Only the runs of this task.",
            "explode": false,
            "in": "query",
            "name": "taskId",
            "schema": {
              "description": "Only the runs of this task.",
              "format": "uuid",
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 0,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RunListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Run history of a service's tasks and one-off commands",
        "tags": [
          "tasks"
        ]
      }
    },
    "/services/{serviceId}/tasks": {
      "get": {
        "operationId": "listServiceTasks",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TaskListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's cron tasks",
        "tags": [
          "tasks"
        ]
      },
      "post": {
        "description": "A cron task runs its command in a throwaway container of the service's current image, with the service's environment and networks, on the service's server. The schedule is evaluated in `timezone` (IANA name, default UTC); one run at most per minute. Keeps the last 50 runs.",
        "operationId": "createServiceTask",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateTaskInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TaskView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Schedule a recurring command",
        "tags": [
          "tasks"
        ]
      }
    },
    "/services/{serviceId}/terminal": {
      "get": {
        "description": "What the caller can do with the service's web terminal and file browser: its replicas, whether a terminal can be opened now, whether production needs a confirmation and whether the file browser may write. Requires the Owner, Admin or Developer role and `deployments:write`; a Viewer gets 403.\n\n**Terminal.** `GET /services/{serviceId}/terminal/ws` upgrades to a WebSocket (browser session cookie, same origin). The first client message is JSON `{\"type\":\"open\",\"replica\":0,\"command\":[…],\"cols\":80,\"rows\":24,\"confirmProduction\":false}`; binary messages are terminal input/output; JSON `{\"type\":\"resize\",\"cols\":…,\"rows\":…}` resizes and `{\"type\":\"close\"}` ends the session. The server answers `opened`, `idle_warning`, `exit`, `error` and `closed` JSON messages. Production services need `confirmProduction: true`. A principal may hold 3 sessions; an idle session (no input for 15 minutes) is closed. Sessions are audited (`terminal.open`, `terminal.close`); their I/O is never recorded.\n\n**Files.** `GET /services/{serviceId}/files/content?replica=\u0026path=\u0026preview=` streams a file (`preview=true` returns at most 1 MiB as text/plain); `POST /services/{serviceId}/files/upload?replica=\u0026path=\u003cdir\u003e\u0026name=\u003cfile\u003e` stores the request body (Content-Length required, 50 MB at most). Uploads are refused in production unless an admin allowed writes for the project.",
        "operationId": "getServiceTerminal",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TerminalInfoView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read",
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "projects:read",
              "deployments:write"
            ]
          }
        ],
        "summary": "Terminal and file browser availability",
        "tags": [
          "terminal"
        ]
      }
    },
    "/services/{serviceId}/variables": {
      "get": {
        "description": "Secret values are never returned: they appear as `{key, isSecret:true, set:true}`. `computedSecret` is also true for a variable that embeds a secret through a reference. `platform` lists the reserved variables NebulaCtrl provides; `exports` the virtual variables other services can reference.",
        "operationId": "listVariables",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's variables",
        "tags": [
          "variables"
        ]
      },
      "put": {
        "description": "Bulk upsert; variables not listed are untouched. Omitting a value keeps the stored one. Values may reference other services (`${{service-slug.KEY}}`), the same service (`${{KEY}}`) and shared variables (`${{shared.KEY}}`), and may contain generators (`${{secret(32)}}`, `${{randomInt(1,6)}}`, `${{uuid()}}`, `${{randomBytes(32,hex)}}`) that run once: writing the same text again keeps the generated value. `$${{` writes a literal `${{`. Variables whose resolved value changes in other services are restaged (`restaged`). Platform variable names (`PORT`, `NEBULA_*`) are rejected with `reserved_variable`.",
        "operationId": "putVariables",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutInputBody2"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Upsert variables (staged until deployed)",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/variables/validate": {
      "post": {
        "description": "Parses the draft, checks generator arguments and dry-run resolves its references in the service's environment. Nothing is written and no generated value is returned.",
        "operationId": "validateVariable",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ValidateVariableInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ValidateVariableResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Validate a draft value",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/variables/{key}": {
      "delete": {
        "operationId": "deleteVariable",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a variable (staged until deployed)",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/variables/{key}/history": {
      "get": {
        "description": "Newest first. Non-secret versions include their value; secrets carry only a fingerprint (equal fingerprints mean equal values).",
        "operationId": "getVariableHistory",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HistoryOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Version history of a variable",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/variables/{key}/history/{version}/restore": {
      "post": {
        "description": "Secrets cannot be restored (`restore_unsupported`); use a release rollback or re-enter the value.",
        "operationId": "restoreVariableVersion",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "format": "int64",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Restore an old non-secret version as a new version",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/variables/{key}/rotate": {
      "post": {
        "description": "Re-runs the generators of a generated variable. `dryRun:true` returns the plan (affected services, deploy order, warnings, blockers) and changes nothing; `dryRun:false` stages the new value and restages the services that consume it. Nothing is deployed. Database credentials and volume-backed passwords are blocked with `rotation_unsupported` once deployed.",
        "operationId": "rotateVariable",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VariableRotateBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableRotationPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Rotate a generated variable (plan or stage)",
        "tags": [
          "variables"
        ]
      }
    },
    "/services/{serviceId}/volume-backup": {
      "delete": {
        "description": "Turns the schedule off. Existing backups and the repository are kept.",
        "operationId": "deleteVolumeBackupConfig",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Remove a service's volume backup configuration",
        "tags": [
          "volume-backups"
        ]
      },
      "get": {
        "description": "Always 200: `configured: false` with the defaults when none is saved. `eligible: false` (with `ineligibleReason`) for services that cannot use volume backups: managed databases (use database backups), route services and services without volumes.",
        "operationId": "getVolumeBackupConfig",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupConfigView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "A service's volume backup configuration",
        "tags": [
          "volume-backups"
        ]
      },
      "put": {
        "description": "Destination, mode, hooks, excludes, retention and the optional schedule. 422 `volume_backup_unavailable` for ineligible services, `invalid_cron` for a bad schedule. The first backup creates the repository.",
        "operationId": "putVolumeBackupConfig",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VolumeBackupConfigInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupConfigView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Save a service's volume backup configuration",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/services/{serviceId}/volume-backup/recovery-key": {
      "post": {
        "description": "The restic repository and password, so a backup can be restored without NebulaCtrl. Requires the admin scope; audited as `volume_backup.recovery_key.reveal`. 422 `volume_backup_unavailable` until the first backup created the repository.",
        "operationId": "revealVolumeBackupRecoveryKey",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RecoveryKeyInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupRecoveryKey"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Reveal the repository password",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/services/{serviceId}/volume-backups": {
      "get": {
        "operationId": "listVolumeBackups",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "explode": false,
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 50,
              "format": "int64",
              "maximum": 200,
              "minimum": 0,
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's volume backups",
        "tags": [
          "volume-backups"
        ]
      },
      "post": {
        "description": "Needs a saved configuration and an online server. Returns 202 with a queued backup; poll it or listen for `backup.updated` events. 409 `server_offline` when it can not start; 422 `volume_backup_unavailable` for ineligible services or without a configuration.",
        "operationId": "createVolumeBackup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateVolumeBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Back up a service's volumes now",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/services/{serviceId}/volume-restores": {
      "get": {
        "operationId": "listVolumeRestores",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeRestoreListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's volume restores",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/services/{serviceId}/volumes": {
      "get": {
        "operationId": "listVolumes",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeListOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List a service's volumes",
        "tags": [
          "volumes"
        ]
      },
      "post": {
        "operationId": "createVolume",
        "parameters": [
          {
            "in": "path",
            "name": "serviceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateVolumeInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Attach a named volume (staged until deployed)",
        "tags": [
          "volumes"
        ]
      }
    },
    "/setup": {
      "get": {
        "operationId": "getSetupStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SetupStatusOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "default": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Whether first-run setup is still required",
        "tags": [
          "setup"
        ]
      },
      "post": {
        "description": "Only works while no users exist; afterwards returns 409 `already_setup`. When the server runs with `NEBULACTRL_SETUP_TOKEN` (the installer sets it) the matching `setupToken` is required (403 `setup_token_invalid`).",
        "operationId": "setup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MeBody"
                }
              }
            },
            "description": "Created"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "429": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {}
        ],
        "summary": "Create the workspace and first user, and sign in",
        "tags": [
          "setup"
        ]
      }
    },
    "/system": {
      "get": {
        "description": "Static facts about this control plane, for the web UI's MCP card and clients that need the endpoint URL.",
        "operationId": "getSystem",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SystemInfo"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Control-plane version, public URL and MCP endpoint",
        "tags": [
          "system"
        ]
      }
    },
    "/task-runs/{runId}": {
      "get": {
        "operationId": "getTaskRun",
        "parameters": [
          {
            "in": "path",
            "name": "runId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RunView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a task run",
        "tags": [
          "tasks"
        ]
      }
    },
    "/task-runs/{runId}/logs": {
      "get": {
        "description": "Without `follow` returns the stored lines as `{items:[{id,stream,line,createdAt}]}` (redacted, at most 10,000 lines). With `follow=true` streams `data: {stream,line,ts}` until the run finishes, then `event: end` with `{status,exitCode}`.",
        "operationId": "getTaskRunLogs",
        "parameters": [
          {
            "in": "path",
            "name": "runId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Stream lines as server-sent events until the run finishes",
            "explode": false,
            "in": "query",
            "name": "follow",
            "schema": {
              "description": "Stream lines as server-sent events until the run finishes",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              },
              "text/event-stream": {
                "schema": {
                  "type": "string"
                }
              }
            },
            "description": "JSON `{items}` without `follow`; a `text/event-stream` with `follow=true`"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "logs:read"
            ]
          },
          {
            "cookie": [
              "logs:read"
            ]
          }
        ],
        "summary": "Output of a task run",
        "tags": [
          "logs",
          "tasks"
        ]
      }
    },
    "/task-schedules/preview": {
      "post": {
        "description": "Validates the expression and returns a plain-English summary (naming the time zone) and the next runs as UTC instants, computed in `timezone` (default UTC). An invalid expression or zone answers 200 with `valid: false` and the reason in `error`.",
        "operationId": "previewTaskSchedule",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PreviewInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SchedulePreview"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Describe a cron expression",
        "tags": [
          "tasks"
        ]
      }
    },
    "/tasks/{taskId}": {
      "delete": {
        "operationId": "deleteServiceTask",
        "parameters": [
          {
            "in": "path",
            "name": "taskId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a cron task and its run history",
        "tags": [
          "tasks"
        ]
      },
      "patch": {
        "operationId": "updateServiceTask",
        "parameters": [
          {
            "in": "path",
            "name": "taskId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchTaskInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TaskView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Update a cron task",
        "tags": [
          "tasks"
        ]
      }
    },
    "/tasks/{taskId}/run": {
      "post": {
        "description": "Starts a run immediately, whatever the schedule and concurrency policy. Returns 202 with the queued run; follow it through `GET /task-runs/{runId}/logs?follow=true`. 409 `not_deployed` / `server_offline` when it can not start.",
        "operationId": "runServiceTask",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "taskId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RunView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Run a cron task now",
        "tags": [
          "tasks"
        ]
      }
    },
    "/team/build-settings": {
      "get": {
        "description": "Projects and services can override the default; resolution is service, then project, then team.",
        "operationId": "getTeamBuildSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TeamSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get the team's default build location and registry",
        "tags": [
          "builds"
        ]
      },
      "put": {
        "description": "With buildLocation build_server, git services build on a build server and push the image to the registry; the deploying server pulls it by digest. Without a usable build server or registry a build falls back to the target server and says so in the deployment's events. Administrators only.",
        "operationId": "putTeamBuildSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PutTeamSettingsInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TeamSettings"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Set the team's default build location and registry",
        "tags": [
          "builds"
        ]
      }
    },
    "/team/shared-variables": {
      "get": {
        "description": "Team variables apply to every project of the team and are referenced as `${{team.KEY}}`. Like shared variables they reach a service only through an explicit `KEY=${{team.KEY}}` variable (see share). Only owners and admins may change them; a principal restricted to some projects has no access. Team values may only reference other team variables, external secrets (`${{vault:integration/path#key}}`), generators and transforms.",
        "operationId": "listTeamSharedVariables",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "List the team's shared variables",
        "tags": [
          "shared-variables"
        ]
      },
      "put": {
        "operationId": "putTeamSharedVariables",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SharedVariablesPutBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Upsert team shared variables (restages consumers in every project)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/team/shared-variables/{key}": {
      "delete": {
        "operationId": "deleteTeamSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a team shared variable",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/team/shared-variables/{key}/history": {
      "get": {
        "operationId": "getTeamSharedVariableHistory",
        "parameters": [
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HistoryOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Version history of a team shared variable",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/team/shared-variables/{key}/rotate": {
      "post": {
        "operationId": "rotateTeamSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/VariableRotateBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VariableRotationPlan"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Rotate a generated team shared variable (plan or stage)",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/team/shared-variables/{key}/share": {
      "post": {
        "operationId": "shareTeamSharedVariable",
        "parameters": [
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ShareSharedInput"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SharedVariableList"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Stage KEY=${{team.KEY}} on services",
        "tags": [
          "shared-variables"
        ]
      }
    },
    "/teams": {
      "get": {
        "description": "Every team the signed-in user belongs to, with their role in each. `current` marks the team the request acts in.",
        "operationId": "listTeams",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListTeamsOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "List the caller's teams",
        "tags": [
          "teams"
        ]
      },
      "post": {
        "description": "The caller becomes its owner. 403 `team_creation_disabled` when the instance admin turned team creation off.",
        "operationId": "createTeam",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateTeamInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Team"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Create a team",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}": {
      "delete": {
        "description": "Owners only. Requires `confirm=\u003cslug\u003e` and a team without servers (409 `team_has_servers`). Deletes every project, token and setting of the team.",
        "operationId": "deleteTeam",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The team's slug",
            "explode": false,
            "in": "query",
            "name": "confirm",
            "schema": {
              "description": "The team's slug",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Delete a team",
        "tags": [
          "teams"
        ]
      },
      "get": {
        "operationId": "getTeam",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Team"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Get a team",
        "tags": [
          "teams"
        ]
      },
      "patch": {
        "operationId": "updateTeam",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RenameTeamInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Team"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Rename a team",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/invites": {
      "get": {
        "operationId": "listTeamInvites",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListInvitesOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List a team's pending invites",
        "tags": [
          "teams"
        ]
      },
      "post": {
        "description": "With `email` the link is mailed (team email channel, else the instance SMTP relay) and works once for that address; without it a link invite is created with an expiry and a use limit. `delivery` tells whether the email went out; the response always carries the link.",
        "operationId": "createTeamInvite",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateInviteInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreatedInvite"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Invite someone to a team",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/invites/{inviteId}": {
      "delete": {
        "operationId": "deleteTeamInvite",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "inviteId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Revoke an invite",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/members": {
      "get": {
        "operationId": "listTeamMembers",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListMembersOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "List a team's members",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/members/{userId}": {
      "delete": {
        "description": "Owners and admins remove members; any member may remove themselves. 409 `last_owner` for the last owner.",
        "operationId": "removeTeamMember",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "userId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Remove a member (or leave the team)",
        "tags": [
          "teams"
        ]
      },
      "patch": {
        "description": "Owners and admins; only owners manage owners. 409 `last_owner` when the change would leave the team without an owner.",
        "operationId": "updateTeamMember",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "userId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpdateMemberInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TeamMember"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Change a member's role or project restriction",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/members/{userId}/password-reset": {
      "post": {
        "description": "Owners and admins (admins cannot reset an owner); signed-in users only. The link works once for 30 minutes, needs no SMTP setup and is shown once. Using it ends every session of the member. 409 `no_password` for members who only sign in through an identity provider.",
        "operationId": "createMemberPasswordResetLink",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "userId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PasswordResetLink"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Generate a password reset link for a member",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/security": {
      "get": {
        "operationId": "getTeamSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TeamSecurityBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "A team's two-factor requirement",
        "tags": [
          "teams"
        ]
      },
      "put": {
        "description": "Members without 2FA are blocked from acting in the team until they enrol. The caller must have 2FA themselves (409 `enrol_first`).",
        "operationId": "setTeamSecurity",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetTeamSecurityInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TeamSecurityBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Require two-factor authentication of every member of the team",
        "tags": [
          "teams"
        ]
      }
    },
    "/teams/{teamId}/switch": {
      "post": {
        "description": "Re-checks membership (404 for non-members) and stores the team in the session. Browser sessions only: an API token belongs to one team.",
        "operationId": "switchTeam",
        "parameters": [
          {
            "in": "path",
            "name": "teamId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Team"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": []
          },
          {
            "cookie": []
          }
        ],
        "summary": "Make a team the session's current team",
        "tags": [
          "teams"
        ]
      }
    },
    "/template-instances/{instanceId}": {
      "delete": {
        "description": "Removes every service of the stack. Requires `confirm=\u003ctemplate id\u003e`. Volumes are kept unless `deleteVolumes=true`.",
        "operationId": "deleteTemplateInstance",
        "parameters": [
          {
            "in": "path",
            "name": "instanceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Must equal the template id",
            "explode": false,
            "in": "query",
            "name": "confirm",
            "schema": {
              "description": "Must equal the template id",
              "type": "string"
            }
          },
          {
            "description": "Also remove the stack's Docker volumes (data is lost)",
            "explode": false,
            "in": "query",
            "name": "deleteVolumes",
            "schema": {
              "description": "Also remove the stack's Docker volumes (data is lost)",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Delete a template stack",
        "tags": [
          "templates"
        ]
      }
    },
    "/template-instances/{instanceId}/update": {
      "get": {
        "description": "Lists what changed between the template as installed and the catalog's current revision: `apply` changes the update would stage, `kept` ones that differ because you changed the service, `manual` ones (new or removed services, database upgrades, published ports) that an update never does. Nothing is written. `blocked` is set for stacks installed before updates existed.",
        "operationId": "getTemplateUpdate",
        "parameters": [
          {
            "in": "path",
            "name": "instanceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TemplateUpdate"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Diff an installed stack against the template's current revision",
        "tags": [
          "templates"
        ]
      },
      "post": {
        "description": "Stages the `apply` changes of the diff as ordinary edits of the stack's services (image, configuration, variables, files, volumes); nothing is deployed, the staged bar and Deploy do that. Fields you changed are kept, secrets are never overwritten, and databases, routes and services are never touched. `revision` must be the revision you reviewed (409 `template_changed` otherwise). A retry after a failure is safe.",
        "operationId": "applyTemplateUpdate",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "instanceId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TemplateUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TemplateUpdateResult"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Stage a template update",
        "tags": [
          "templates"
        ]
      }
    },
    "/tokens": {
      "get": {
        "operationId": "listTokens",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListTokensOutputBody"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "List API tokens",
        "tags": [
          "tokens"
        ]
      },
      "post": {
        "operationId": "createToken",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateTokenInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CreatedToken"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Create an API token",
        "tags": [
          "tokens"
        ]
      }
    },
    "/tokens/{id}": {
      "delete": {
        "operationId": "revokeToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "admin"
            ]
          },
          {
            "cookie": [
              "admin"
            ]
          }
        ],
        "summary": "Revoke an API token",
        "tags": [
          "tokens"
        ]
      }
    },
    "/volume-backups/{backupId}": {
      "delete": {
        "description": "Removes the snapshot through the agent. 409 `backup_locked`, `backup_in_progress` or `server_offline`.",
        "operationId": "deleteVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Delete a volume backup",
        "tags": [
          "volume-backups"
        ]
      },
      "get": {
        "operationId": "getVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:read"
            ]
          },
          {
            "cookie": [
              "projects:read"
            ]
          }
        ],
        "summary": "Get a volume backup",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/volume-backups/{backupId}/files": {
      "get": {
        "description": "Lists one directory of one volume inside the snapshot (at most 5000 entries). The agent reads the repository, so the server must be online (409 `server_offline`). Requires the `deployments:write` scope: backups can contain secrets.\n\n**Download.** `GET /volume-backups/{backupId}/files/content?volume=\u0026path=\u0026archive=` streams a file (`Content-Disposition: attachment`); a directory is downloaded as a `.zip` with `archive=true`. Audited as `volume_backup.file.download`.",
        "operationId": "listVolumeBackupFiles",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "The volume's name in the service.",
            "explode": false,
            "in": "query",
            "name": "volume",
            "schema": {
              "description": "The volume's name in the service.",
              "maxLength": 63,
              "minLength": 1,
              "type": "string"
            }
          },
          {
            "description": "Absolute directory path inside the volume.",
            "explode": false,
            "in": "query",
            "name": "path",
            "schema": {
              "default": "/",
              "description": "Absolute directory path inside the volume.",
              "maxLength": 4096,
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeFileListing"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Browse the files of a volume backup",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/volume-backups/{backupId}/lock": {
      "put": {
        "description": "Locked backups are never removed by retention or deleted.",
        "operationId": "lockVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LockVolumeBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeBackupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Lock or unlock a volume backup",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/volume-backups/{backupId}/restore": {
      "post": {
        "description": "mode `new_volume` (default) restores into a new Docker volume and stages the swap on the service: apply it with Deploy; the current volume is kept as a retired volume. mode `in_place` first takes a safety backup, then stops the service, overwrites the volume and starts it again; it needs `confirmSlug`. 409 `backup_not_restorable`, `server_offline`, `backup_in_progress`; 422 `confirmation_required`.",
        "operationId": "restoreVolumeBackup",
        "parameters": [
          {
            "description": "Client-chosen key (\u003c=255 chars). A retry with the same key replays the original response for 24 hours.",
            "in": "header",
            "name": "Idempotency-Key",
            "schema": {
              "maxLength": 255,
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "backupId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RestoreVolumeBackupInputBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VolumeRestoreView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Conflict"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "deployments:write"
            ]
          },
          {
            "cookie": [
              "deployments:write"
            ]
          }
        ],
        "summary": "Restore a volume of a backup",
        "tags": [
          "volume-backups"
        ]
      }
    },
    "/volumes/{volumeId}": {
      "delete": {
        "operationId": "deleteVolume",
        "parameters": [
          {
            "in": "path",
            "name": "volumeId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "bearer": [
              "projects:write"
            ]
          },
          {
            "cookie": [
              "projects:write"
            ]
          }
        ],
        "summary": "Detach a volume (staged); the Docker volume and its data are kept",
        "tags": [
          "volumes"
        ]
      }
    }
  },
  "security": [
    {
      "bearer": []
    },
    {
      "cookie": []
    }
  ],
  "servers": [
    {
      "url": "/api/v1"
    }
  ],
  "tags": [
    {
      "description": "First-run bootstrap",
      "name": "setup"
    },
    {
      "description": "Sessions",
      "name": "auth"
    },
    {
      "description": "Current principal",
      "name": "me"
    },
    {
      "description": "API tokens",
      "name": "tokens"
    },
    {
      "description": "Projects",
      "name": "projects"
    },
    {
      "description": "Environments",
      "name": "environments"
    },
    {
      "description": "Services",
      "name": "services"
    },
    {
      "description": "Service variables",
      "name": "variables"
    },
    {
      "description": "Service domains",
      "name": "domains"
    },
    {
      "description": "Service volumes",
      "name": "volumes"
    },
    {
      "description": "Service links",
      "name": "links"
    },
    {
      "description": "Deployments and releases",
      "name": "deployments"
    },
    {
      "description": "Canvas layouts",
      "name": "canvas"
    },
    {
      "description": "Servers and agents",
      "name": "servers"
    },
    {
      "description": "Logs",
      "name": "logs"
    },
    {
      "description": "Metrics",
      "name": "metrics"
    },
    {
      "description": "Audit log",
      "name": "audit"
    },
    {
      "description": "Live invalidation feed",
      "name": "events"
    },
    {
      "description": "Control-plane info",
      "name": "system"
    },
    {
      "description": "Teams, members, invites and instance settings",
      "name": "teams"
    },
    {
      "description": "Production approvals for AI clients",
      "name": "approvals"
    }
  ]
}