openapi: 3.1.0
info:
  title: Elaichi API
  version: 0.1.0
  description: Control-plane HTTP API for Elaichi — the MCP control plane for SaaS
    teams. Staff-only `/admin/*` routes and local-development endpoints are not
    documented here.
servers:
  - url: https://api.elaichi.ai
    description: Production
tags:
  - name: Health
  - name: Auth
  - name: Current user
  - name: Organizations
  - name: Entitlements
  - name: Permissions
  - name: Roles
  - name: Teams
  - name: Members
  - name: Invites
  - name: Org domains
  - name: API tokens
  - name: Audit log
  - name: Connectors
  - name: Connections
  - name: Toolboxes
  - name: User toolboxes
  - name: Synthetic tools
  - name: MCP servers
  - name: MCP data plane
  - name: Restrictions
  - name: Logging destinations
  - name: SSO
  - name: SCIM
  - name: SCIM data plane
  - name: Group mappings
paths:
  /health:
    get:
      operationId: getHealth
      summary: Health check
      tags:
        - Health
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  service:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
  /auth/providers:
    get:
      operationId: getAuthProviders
      summary: List configured social auth providers
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  providers:
                    type: array
                    items:
                      type: string
                  signup_enabled:
                    type: boolean
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
  /auth/sso/{provider}:
    get:
      operationId: startSocialSso
      summary: Start social login
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to IdP authorize URL
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Responds 302 to the provider authorize URL. provider ∈ google |
        github | microsoft.
      security: []
      parameters:
        - name: provider
          in: path
          required: true
          schema:
            type: string
          description: google | github | microsoft
        - name: redirect_uri
          in: query
          schema:
            type: string
          description: App-relative path after login (default /).
  /auth/sso/{provider}/callback:
    get:
      operationId: socialSsoCallback
      summary: Social OAuth callback
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to APP_URL + redirect_uri or /auth/error
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: provider
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: code
          in: query
          schema:
            type: string
        - name: state
          in: query
          schema:
            type: string
  /auth/logout:
    post:
      operationId: logout
      summary: Log out
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /auth/signup:
    post:
      operationId: signup
      summary: Passwordless public registration
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Hidden (404) when PUBLIC_SIGNUP !== "true". Always returns success
        to avoid enumeration.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - email
                - org_name
              properties:
                name:
                  type: string
                email:
                  type: string
                  format: email
                org_name:
                  type: string
                redirect:
                  type: string
  /auth/signup/resend:
    post:
      operationId: signupResend
      summary: Resend signup activation email
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - email
              properties:
                email:
                  type: string
                  format: email
                redirect:
                  type: string
  /auth/signup/activate:
    get:
      operationId: signupActivate
      summary: Activate signup from emailed link
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to APP_URL + stored redirect or /auth/error
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: token
          in: query
          required: true
          schema:
            type: string
  /auth/magic-link:
    post:
      operationId: requestMagicLink
      summary: Request magic-link login email
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - email
              properties:
                email:
                  type: string
                  format: email
                redirect:
                  type: string
  /auth/magic-link/verify:
    get:
      operationId: verifyMagicLink
      summary: Verify magic-link token
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to APP_URL or /auth/error
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: token
          in: query
          required: true
          schema:
            type: string
  /auth/mfa/verify:
    post:
      operationId: verifyMfa
      summary: Complete MFA challenge for mfa_pending session
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - code
              properties:
                code:
                  type: string
  /auth/invite/activate:
    get:
      operationId: activateInvite
      summary: Activate invite from emailed link
      tags:
        - Auth
      responses:
        "302":
          description: Redirect into the app or invite error
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: token
          in: query
          required: true
          schema:
            type: string
  /auth/oidc/resolve:
    get:
      operationId: resolveOidc
      summary: Resolve email to SSO login URL
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  connection:
                    type:
                      - object
                      - "null"
                    properties:
                      id:
                        type: string
                      protocol:
                        type: string
                        enum:
                          - oidc
                          - saml
                      login_url:
                        type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: email
          in: query
          required: true
          schema:
            type: string
  /auth/oidc/{connectionId}/login:
    get:
      operationId: oidcLogin
      summary: Start OIDC login
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to IdP
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/oidc/{connectionId}/callback:
    get:
      operationId: oidcCallback
      summary: OIDC callback
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to APP_URL
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/saml/{connectionId}/login:
    get:
      operationId: samlLogin
      summary: Start SAML login
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to IdP
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/saml/{connectionId}/acs:
    post:
      operationId: samlAcs
      summary: SAML ACS (HTTP-POST)
      tags:
        - Auth
      responses:
        "302":
          description: Redirect to APP_URL
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/saml/{connectionId}/metadata:
    get:
      operationId: samlMetadata
      summary: SAML SP metadata
      tags:
        - Auth
      responses:
        "200":
          description: SP metadata XML
          content:
            application/xml:
              schema:
                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/step-up/options:
    post:
      operationId: stepUpOptions
      summary: Begin step-up reauthentication
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  factor:
                    type: string
                    enum:
                      - passkey
                      - totp
                  challenge_id:
                    type: string
                  options:
                    type: object
                    additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - action
                - resource_id
              properties:
                action:
                  type: string
                resource_id:
                  type: string
  /auth/step-up/verify:
    post:
      operationId: stepUpVerify
      summary: Verify step-up challenge
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  expires_in:
                    type: integer
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - action
                - resource_id
                - challenge_id
              properties:
                action:
                  type: string
                resource_id:
                  type: string
                challenge_id:
                  type: string
                response:
                  type: object
                  additionalProperties: true
                code:
                  type: string
  /auth/passkey/registration/options:
    post:
      operationId: passkeyRegistrationOptions
      summary: Passkey registration options
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /auth/passkey/registration/verify:
    post:
      operationId: passkeyRegistrationVerify
      summary: Verify passkey registration
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - challenge_id
                - response
              properties:
                challenge_id:
                  type: string
                response:
                  type: object
                  additionalProperties: true
                name:
                  type:
                    - string
                    - "null"
  /auth/passkey:
    get:
      operationId: listPasskeys
      summary: List passkeys
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /auth/passkey/{id}:
    patch:
      operationId: renamePasskey
      summary: Rename passkey
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deletePasskey
      summary: Delete passkey
      tags:
        - Auth
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /auth/passkey/authentication/options:
    post:
      operationId: passkeyAuthenticationOptions
      summary: Passkey authentication options (public)
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
  /auth/passkey/authentication/verify:
    post:
      operationId: passkeyAuthenticationVerify
      summary: Verify passkey authentication
      tags:
        - Auth
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
  /user/me:
    get:
      operationId: getCurrentUser
      summary: Current user bootstrap payload
      tags:
        - Current user
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                allOf:
                  - $ref: "#/components/schemas/User"
                  - type: object
                    properties:
                      is_staff:
                        type: boolean
                      is_root_org_staff:
                        type: boolean
                      mfa_enabled:
                        type: boolean
                      organizations:
                        type: array
                        items:
                          type: object
                          properties:
                            organization:
                              $ref: "#/components/schemas/Organization"
                            member:
                              $ref: "#/components/schemas/Member"
                            roles:
                              type: array
                              items:
                                type: object
                                additionalProperties: true
                            teams:
                              type: array
                              items:
                                type: object
                                additionalProperties: true
                            permissions:
                              type: array
                              items:
                                type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /user/me/mfa/totp:
    post:
      operationId: startTotpEnrollment
      summary: Begin TOTP enrollment
      tags:
        - Current user
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  secret:
                    type: string
                  otpauth_uri:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
    delete:
      operationId: disableTotp
      summary: Disable TOTP (requires step-up)
      tags:
        - Current user
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /user/me/mfa/totp/verify:
    post:
      operationId: verifyTotpEnrollment
      summary: Verify TOTP enrollment and get backup codes
      tags:
        - Current user
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  backup_codes:
                    type: array
                    items:
                      type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - code
              properties:
                code:
                  type: string
  /user/me/mfa/recovery-codes/regenerate:
    post:
      operationId: regenerateRecoveryCodes
      summary: Regenerate MFA recovery codes (requires step-up)
      tags:
        - Current user
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  backup_codes:
                    type: array
                    items:
                      type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /organization:
    post:
      operationId: createOrganization
      summary: Create organization
      tags:
        - Organizations
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Organization"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Requires PUBLIC_SIGNUP=true; otherwise 403 signup_disabled.
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
                slug:
                  type: string
    get:
      operationId: listOrganizations
      summary: List organizations for current user
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/Organization"
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /organization/{id}:
    get:
      operationId: getOrganization
      summary: Get organization
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Organization"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: patchOrganization
      summary: Update organization
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Organization"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                settings:
                  type: object
                  additionalProperties: true
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /organization/{id}/logo:
    put:
      operationId: putOrganizationLogo
      summary: Upload organization logo
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Organization"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Raw image body (png/jpeg/webp), max 2 MiB.
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          image/png:
            schema:
              type: string
              format: binary
          image/jpeg:
            schema:
              type: string
              format: binary
          image/webp:
            schema:
              type: string
              format: binary
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteOrganizationLogo
      summary: Remove organization logo
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Organization"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /organization/{id}/entitlements:
    get:
      operationId: getOrganizationEntitlements
      summary: Get effective plan and feature map
      tags:
        - Entitlements
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  plan:
                    type:
                      - string
                      - "null"
                    enum:
                      - gold
                      - black
                      - none
                      - null
                  trial_ends_at:
                    type:
                      - string
                      - "null"
                    format: date-time
                  trial_active:
                    type: boolean
                  features:
                    type: object
                    additionalProperties:
                      type: boolean
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /organization/{id}/billing:
    get:
      operationId: getOrganizationBilling
      summary: Billing status
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /organization/{id}/billing/checkout:
    post:
      operationId: createBillingCheckout
      summary: Create Stripe Checkout session
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  url:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - plan
              properties:
                plan:
                  type: string
                  enum:
                    - gold
                    - black
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /organization/{id}/billing/portal:
    post:
      operationId: createBillingPortal
      summary: Create Stripe Customer Portal session
      tags:
        - Organizations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  url:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /permission:
    get:
      operationId: listPermissions
      summary: Permission catalog
      tags:
        - Permissions
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                        description:
                          type: string
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
  /role:
    get:
      operationId: listRoles
      summary: List roles
      tags:
        - Roles
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/Role"
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createRole
      summary: Create role
      tags:
        - Roles
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Role"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - permissions
              properties:
                name:
                  type: string
                description:
                  type: string
                permissions:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /role/{id}:
    get:
      operationId: getRole
      summary: Get role
      tags:
        - Roles
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Role"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: patchRole
      summary: Update role
      tags:
        - Roles
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Role"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                description:
                  type: string
                permissions:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteRole
      summary: Delete role
      tags:
        - Roles
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /team:
    get:
      operationId: listTeams
      summary: List teams
      tags:
        - Teams
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/Team"
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createTeam
      summary: Create team
      tags:
        - Teams
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Team"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
                description:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /team/{id}:
    get:
      operationId: getTeam
      summary: Get team
      tags:
        - Teams
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Team"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: patchTeam
      summary: Update team
      tags:
        - Teams
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Team"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                description:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteTeam
      summary: Delete team
      tags:
        - Teams
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /team/{id}/members:
    post:
      operationId: addTeamMember
      summary: Add team member
      tags:
        - Teams
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Team"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - user_id
              properties:
                user_id:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /team/{id}/members/{userId}:
    delete:
      operationId: removeTeamMember
      summary: Remove team member
      tags:
        - Teams
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Team"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: userId
          in: path
          required: true
          schema:
            type: string
          description: User id
  /member:
    get:
      operationId: listMembers
      summary: List members
      tags:
        - Members
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/Member"
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /member/{userId}:
    patch:
      operationId: patchMember
      summary: Replace member roles
      tags:
        - Members
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Member"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - role_ids
              properties:
                role_ids:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: userId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteMember
      summary: Remove member
      tags:
        - Members
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Optional connection_actions resolve personal connections before
        removal. 409 connections_need_resolution when shared connections lack
        actions.
      security:
        - bearerAuth: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                connection_actions:
                  type: array
                  items:
                    type: object
                    required:
                      - connection_id
                      - action
                    properties:
                      connection_id:
                        type: string
                      action:
                        type: string
                        enum:
                          - transfer_org
                          - transfer_team
                          - transfer_user
                          - delete
                      team_id:
                        type: string
                      target_user_id:
                        type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: userId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /member/{userId}/offboarding:
    get:
      operationId: getMemberOffboarding
      summary: Offboarding preflight for member removal
      tags:
        - Members
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  user_id:
                    type: string
                  connections:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: userId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /invite:
    get:
      operationId: listInvites
      summary: List pending invites
      tags:
        - Invites
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        email:
                          type: string
                        role_ids:
                          type: array
                          items:
                            type: string
                        team_ids:
                          type: array
                          items:
                            type: string
                        status:
                          type: string
                        expires_at:
                          type: string
                          format: date-time
                        invited_by:
                          type: string
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createInvite
      summary: Create invite
      tags:
        - Invites
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                allOf:
                  - type: object
                    properties:
                      id:
                        type: string
                      email:
                        type: string
                      role_ids:
                        type: array
                        items:
                          type: string
                      team_ids:
                        type: array
                        items:
                          type: string
                      status:
                        type: string
                      expires_at:
                        type: string
                        format: date-time
                      invited_by:
                        type: string
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  - type: object
                    properties:
                      token:
                        type: string
                      email_sent:
                        type: boolean
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - email
              properties:
                email:
                  type: string
                  format: email
                role_ids:
                  type: array
                  items:
                    type: string
                team_ids:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /invite/{id}:
    delete:
      operationId: deleteInvite
      summary: Delete pending invite
      tags:
        - Invites
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /invite/accept:
    post:
      operationId: acceptInvite
      summary: Accept invite (global, no org header)
      tags:
        - Invites
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  organization:
                    $ref: "#/components/schemas/Organization"
                  member:
                    $ref: "#/components/schemas/Member"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
  /org-domain:
    get:
      operationId: listOrgDomains
      summary: List org domains
      tags:
        - Org domains
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        organization_id:
                          type: string
                        domain:
                          type: string
                        verified:
                          type: boolean
                        verification_record:
                          type: string
                        default_role_id:
                          type:
                            - string
                            - "null"
                        sso_connection_id:
                          type:
                            - string
                            - "null"
                        detail:
                          type:
                            - string
                            - "null"
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createOrgDomain
      summary: Claim org domain
      tags:
        - Org domains
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  organization_id:
                    type: string
                  domain:
                    type: string
                  verified:
                    type: boolean
                  verification_record:
                    type: string
                  default_role_id:
                    type:
                      - string
                      - "null"
                  sso_connection_id:
                    type:
                      - string
                      - "null"
                  detail:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - domain
              properties:
                domain:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /org-domain/{id}:
    patch:
      operationId: patchOrgDomain
      summary: Update org domain defaults
      tags:
        - Org domains
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  organization_id:
                    type: string
                  domain:
                    type: string
                  verified:
                    type: boolean
                  verification_record:
                    type: string
                  default_role_id:
                    type:
                      - string
                      - "null"
                  sso_connection_id:
                    type:
                      - string
                      - "null"
                  detail:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                default_role_id:
                  type:
                    - string
                    - "null"
                sso_connection_id:
                  type:
                    - string
                    - "null"
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteOrgDomain
      summary: Delete org domain
      tags:
        - Org domains
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /org-domain/{id}/verify:
    post:
      operationId: verifyOrgDomain
      summary: Verify org domain DNS TXT
      tags:
        - Org domains
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  organization_id:
                    type: string
                  domain:
                    type: string
                  verified:
                    type: boolean
                  verification_record:
                    type: string
                  default_role_id:
                    type:
                      - string
                      - "null"
                  sso_connection_id:
                    type:
                      - string
                      - "null"
                  detail:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /api-token:
    get:
      operationId: listApiTokens
      summary: List API tokens
      tags:
        - API tokens
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        organization_id:
                          type: string
                        user_id:
                          type: string
                        name:
                          type: string
                        last_used_at:
                          type:
                            - string
                            - "null"
                          format: date-time
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createApiToken
      summary: Create API token
      tags:
        - API tokens
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                allOf:
                  - type: object
                    properties:
                      id:
                        type: string
                      organization_id:
                        type: string
                      user_id:
                        type: string
                      name:
                        type: string
                      last_used_at:
                        type:
                          - string
                          - "null"
                        format: date-time
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  - type: object
                    properties:
                      token:
                        type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /api-token/{id}:
    delete:
      operationId: deleteApiToken
      summary: Revoke API token (requires step-up)
      tags:
        - API tokens
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /audit-log:
    get:
      operationId: listAuditLog
      summary: List audit log events
      tags:
        - Audit log
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        actor_user_id:
                          type: string
                        action:
                          type: string
                        resource_type:
                          type: string
                        resource_id:
                          type: string
                        metadata:
                          type: object
                          additionalProperties: true
                        created_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /connector:
    get:
      operationId: listConnectors
      summary: List connectors
      tags:
        - Connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        slug:
                          type: string
                        label:
                          type: string
                        category:
                          type: string
                        logo:
                          type:
                            - string
                            - "null"
                        description:
                          type:
                            - string
                            - "null"
                        owner:
                          type: string
                        custom:
                          type: boolean
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: search
          in: query
          schema:
            type: string
        - name: category
          in: query
          schema:
            type: string
        - name: custom
          in: query
          schema:
            type: boolean
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createCustomConnector
      summary: Create custom connector
      tags:
        - Custom connectors
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - slug
                - label
                - config
              properties:
                slug:
                  type: string
                label:
                  type: string
                category:
                  type: string
                config:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /connector/{slug}:
    get:
      operationId: getConnector
      summary: Get connector detail
      tags:
        - Connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Connector slug
    patch:
      operationId: patchCustomConnector
      summary: Update custom connector
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                label:
                  type: string
                category:
                  type: string
                config:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteCustomConnector
      summary: Delete custom connector
      tags:
        - Custom connectors
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/tools:
    get:
      operationId: listConnectorTools
      summary: List connector tools
      tags:
        - Connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                        description:
                          type: string
                        resource:
                          type: string
                        method:
                          type: string
                        input_schema:
                          type: object
                          additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /connector/{slug}/fork:
    post:
      operationId: forkConnector
      summary: Fork connector into org-owned copy
      tags:
        - Custom connectors
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                new_slug:
                  type: string
                label:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/pull:
    get:
      operationId: previewConnectorPull
      summary: Preview upstream changes for forked connector
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    post:
      operationId: applyConnectorPull
      summary: Apply selected upstream changes
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - change_ids
              properties:
                change_ids:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/link-upstream:
    post:
      operationId: linkConnectorUpstream
      summary: Attach upstream lineage
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - upstream_slug
              properties:
                upstream_slug:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/documentation:
    put:
      operationId: putConnectorDocumentation
      summary: Bulk upsert connector documentation
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                properties:
                  resource:
                    type: string
                  method:
                    type: string
                  description:
                    type: string
                  query_schema: {}
                  body_schema: {}
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/share:
    get:
      operationId: listConnectorShares
      summary: List connector ACL shares
      tags:
        - Custom connectors
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    post:
      operationId: shareConnector
      summary: Share custom connector
      tags:
        - Custom connectors
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - grantee_type
                - level
              properties:
                grantee_type:
                  type: string
                  enum:
                    - user
                    - team
                    - org
                grantee_id:
                  type: string
                level:
                  type: string
                  enum:
                    - view
                    - edit
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connector/{slug}/share/{aclId}:
    delete:
      operationId: revokeConnectorShare
      summary: Revoke connector share
      tags:
        - Custom connectors
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: slug
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: aclId
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connection:
    get:
      operationId: listConnections
      summary: List connections
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        connector_slug:
                          type: string
                        name:
                          type: string
                        scope:
                          type: string
                          enum:
                            - user
                            - team
                            - org
                        team_id:
                          type:
                            - string
                            - "null"
                        owner_user_id:
                          type: string
                        saffron_account_id:
                          type:
                            - string
                            - "null"
                        status:
                          type: string
                        last_error:
                          type:
                            - string
                            - "null"
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createConnection
      summary: Create connection
      tags:
        - Connections
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  connection:
                    type: object
                    properties:
                      id:
                        type: string
                      connector_slug:
                        type: string
                      name:
                        type: string
                      scope:
                        type: string
                        enum:
                          - user
                          - team
                          - org
                      team_id:
                        type:
                          - string
                          - "null"
                      owner_user_id:
                        type: string
                      saffron_account_id:
                        type:
                          - string
                          - "null"
                      status:
                        type: string
                      last_error:
                        type:
                          - string
                          - "null"
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  connect_url:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - connector_slug
              properties:
                connector_slug:
                  type: string
                scope:
                  type: string
                  enum:
                    - user
                    - team
                    - org
                team_id:
                  type:
                    - string
                    - "null"
                redirect_uri:
                  type: string
                name:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /connection/{id}:
    get:
      operationId: getConnection
      summary: Get connection
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  connector_slug:
                    type: string
                  name:
                    type: string
                  scope:
                    type: string
                    enum:
                      - user
                      - team
                      - org
                  team_id:
                    type:
                      - string
                      - "null"
                  owner_user_id:
                    type: string
                  saffron_account_id:
                    type:
                      - string
                      - "null"
                  status:
                    type: string
                  last_error:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: patchConnection
      summary: Rename connection
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  connector_slug:
                    type: string
                  name:
                    type: string
                  scope:
                    type: string
                    enum:
                      - user
                      - team
                      - org
                  team_id:
                    type:
                      - string
                      - "null"
                  owner_user_id:
                    type: string
                  saffron_account_id:
                    type:
                      - string
                      - "null"
                  status:
                    type: string
                  last_error:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteConnection
      summary: Delete connection
      tags:
        - Connections
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connection/{id}/callback:
    get:
      operationId: connectionCallback
      summary: Saffron connect callback (browser redirect)
      tags:
        - Connections
      responses:
        "302":
          description: Redirect to APP_URL
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connection/{id}/reconnect:
    post:
      operationId: reconnectConnection
      summary: Reconnect connection
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  connection:
                    type: object
                    properties:
                      id:
                        type: string
                      connector_slug:
                        type: string
                      name:
                        type: string
                      scope:
                        type: string
                        enum:
                          - user
                          - team
                          - org
                      team_id:
                        type:
                          - string
                          - "null"
                      owner_user_id:
                        type: string
                      saffron_account_id:
                        type:
                          - string
                          - "null"
                      status:
                        type: string
                      last_error:
                        type:
                          - string
                          - "null"
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  connect_url:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                redirect_uri:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /connection/{id}/tools:
    get:
      operationId: listConnectionTools
      summary: List tools for a connection
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                        description:
                          type: string
                        resource:
                          type: string
                        method:
                          type: string
                        input_schema:
                          type: object
                          additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /connection/{id}/transfer:
    post:
      operationId: transferConnection
      summary: Transfer connection ownership
      tags:
        - Connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  connector_slug:
                    type: string
                  name:
                    type: string
                  scope:
                    type: string
                    enum:
                      - user
                      - team
                      - org
                  team_id:
                    type:
                      - string
                      - "null"
                  owner_user_id:
                    type: string
                  saffron_account_id:
                    type:
                      - string
                      - "null"
                  status:
                    type: string
                  last_error:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - owner_scope
              properties:
                owner_scope:
                  type: string
                  enum:
                    - org
                    - team
                    - user
                team_id:
                  type: string
                owner_user_id:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /toolbox:
    get:
      operationId: listToolboxes
      summary: List toolboxes visible to the caller
      tags:
        - Toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                        description:
                          type:
                            - string
                            - "null"
                        is_template:
                          type: boolean
                        owner_user_id:
                          type: string
                        entries:
                          type: array
                          items:
                            type: object
                            additionalProperties: true
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createToolbox
      summary: Create a toolbox
      tags:
        - Toolboxes
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  is_template:
                    type: boolean
                  owner_user_id:
                    type: string
                  entries:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
                description:
                  type:
                    - string
                    - "null"
                is_template:
                  type: boolean
                entries:
                  type: array
                  items:
                    type: object
                    properties:
                      tool_name:
                        type: string
                      connector_slug:
                        type: string
                      connection_id:
                        type:
                          - string
                          - "null"
                      display_name:
                        type: string
                      description:
                        type: string
                      input_schema:
                        type: object
                        additionalProperties: true
                      frozen_params:
                        type: object
                        additionalProperties: true
                      default_params:
                        type: object
                        additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /toolbox/{id}:
    get:
      operationId: getToolbox
      summary: Get a toolbox
      tags:
        - Toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  is_template:
                    type: boolean
                  owner_user_id:
                    type: string
                  entries:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateToolbox
      summary: Update a toolbox (entries replace wholesale when provided)
      tags:
        - Toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  is_template:
                    type: boolean
                  owner_user_id:
                    type: string
                  entries:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                description:
                  type:
                    - string
                    - "null"
                is_template:
                  type: boolean
                entries:
                  type: array
                  items:
                    type: object
                    properties:
                      tool_name:
                        type: string
                      connector_slug:
                        type: string
                      connection_id:
                        type:
                          - string
                          - "null"
                      display_name:
                        type: string
                      description:
                        type: string
                      input_schema:
                        type: object
                        additionalProperties: true
                      frozen_params:
                        type: object
                        additionalProperties: true
                      default_params:
                        type: object
                        additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteToolbox
      summary: Delete a toolbox
      tags:
        - Toolboxes
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /toolbox/{id}/share:
    get:
      operationId: listToolboxShares
      summary: List toolbox ACL shares
      tags:
        - Toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    post:
      operationId: shareToolbox
      summary: Share a toolbox
      tags:
        - Toolboxes
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - grantee_type
                - permission
              properties:
                grantee_type:
                  type: string
                  enum:
                    - user
                    - team
                    - org
                grantee_id:
                  type: string
                permission:
                  type: string
                  enum:
                    - view
                    - use
                    - edit
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /toolbox/{id}/share/{aclId}:
    delete:
      operationId: revokeToolboxShare
      summary: Revoke a toolbox share
      tags:
        - Toolboxes
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: aclId
          in: path
          required: true
          schema:
            type: string
          description: ACL id
  /user-toolbox:
    get:
      operationId: listUserToolboxes
      summary: List user toolboxes (template + dynamic)
      tags:
        - User toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                        description:
                          type:
                            - string
                            - "null"
                        kind:
                          type: string
                          enum:
                            - template
                            - connection
                            - global
                            - synthetic
                        toolbox_id:
                          type:
                            - string
                            - "null"
                        connection_id:
                          type:
                            - string
                            - "null"
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createUserToolbox
      summary: Instantiate a template toolbox for the caller
      tags:
        - User toolboxes
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  kind:
                    type: string
                    enum:
                      - template
                      - connection
                      - global
                      - synthetic
                  toolbox_id:
                    type:
                      - string
                      - "null"
                  connection_id:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - toolbox_id
              properties:
                toolbox_id:
                  type: string
                name:
                  type: string
                bindings:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /user-toolbox/{id}:
    get:
      operationId: getUserToolbox
      summary: Get a user toolbox (owner only)
      tags:
        - User toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  kind:
                    type: string
                    enum:
                      - template
                      - connection
                      - global
                      - synthetic
                  toolbox_id:
                    type:
                      - string
                      - "null"
                  connection_id:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateUserToolbox
      summary: Update a user toolbox (dynamic ids → 400)
      tags:
        - User toolboxes
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type:
                      - string
                      - "null"
                  kind:
                    type: string
                    enum:
                      - template
                      - connection
                      - global
                      - synthetic
                  toolbox_id:
                    type:
                      - string
                      - "null"
                  connection_id:
                    type:
                      - string
                      - "null"
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                description:
                  type:
                    - string
                    - "null"
                bindings:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteUserToolbox
      summary: Delete a user toolbox (dynamic ids → 400)
      tags:
        - User toolboxes
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /synthetic-tool:
    get:
      operationId: listSyntheticTools
      summary: List synthetic tools
      tags:
        - Synthetic tools
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createSyntheticTool
      summary: Create a synthetic tool
      tags:
        - Synthetic tools
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - steps
              properties:
                name:
                  type: string
                description:
                  type: string
                input_schema:
                  type: object
                  additionalProperties: true
                steps:
                  type: array
                  items:
                    type: object
                    additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /synthetic-tool/{id}:
    get:
      operationId: getSyntheticTool
      summary: Get a synthetic tool
      tags:
        - Synthetic tools
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateSyntheticTool
      summary: Update a synthetic tool
      tags:
        - Synthetic tools
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteSyntheticTool
      summary: Delete a synthetic tool
      tags:
        - Synthetic tools
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /synthetic-tool/{id}/execute:
    post:
      operationId: executeSyntheticTool
      summary: Execute a synthetic tool
      tags:
        - Synthetic tools
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                arguments:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /mcp-server:
    get:
      operationId: listMcpServers
      summary: List MCP servers for the caller
      tags:
        - MCP servers
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        user_toolbox_id:
                          type: string
                        name:
                          type: string
                        require_org_api_token:
                          type: boolean
                        token_prefix:
                          type: string
                        last_used_at:
                          type:
                            - string
                            - "null"
                          format: date-time
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /user-toolbox/{id}/mcp:
    get:
      operationId: listUserToolboxMcpServers
      summary: List MCP servers for a user toolbox
      tags:
        - MCP servers
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        user_toolbox_id:
                          type: string
                        name:
                          type: string
                        require_org_api_token:
                          type: boolean
                        token_prefix:
                          type: string
                        last_used_at:
                          type:
                            - string
                            - "null"
                          format: date-time
                        created_at:
                          type: string
                          format: date-time
                        updated_at:
                          type: string
                          format: date-time
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    post:
      operationId: createMcpServer
      summary: Mint an MCP endpoint for a user toolbox
      tags:
        - MCP servers
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                allOf:
                  - type: object
                    properties:
                      id:
                        type: string
                      user_toolbox_id:
                        type: string
                      name:
                        type: string
                      require_org_api_token:
                        type: boolean
                      token_prefix:
                        type: string
                      last_used_at:
                        type:
                          - string
                          - "null"
                        format: date-time
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  - type: object
                    properties:
                      token:
                        type: string
                        description: Shown once
                      url:
                        type: string
                        format: uri
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Returns the raw token once. Store it; it cannot be retrieved again.
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                require_org_api_token:
                  type: boolean
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /user-toolbox/{id}/mcp/{mcpId}:
    get:
      operationId: getMcpServer
      summary: Get an MCP server
      tags:
        - MCP servers
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  user_toolbox_id:
                    type: string
                  name:
                    type: string
                  require_org_api_token:
                    type: boolean
                  token_prefix:
                    type: string
                  last_used_at:
                    type:
                      - string
                      - "null"
                    format: date-time
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: mcpId
          in: path
          required: true
          schema:
            type: string
          description: MCP server id
    patch:
      operationId: updateMcpServer
      summary: Update an MCP server
      tags:
        - MCP servers
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  user_toolbox_id:
                    type: string
                  name:
                    type: string
                  require_org_api_token:
                    type: boolean
                  token_prefix:
                    type: string
                  last_used_at:
                    type:
                      - string
                      - "null"
                    format: date-time
                  created_at:
                    type: string
                    format: date-time
                  updated_at:
                    type: string
                    format: date-time
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                require_org_api_token:
                  type: boolean
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: mcpId
          in: path
          required: true
          schema:
            type: string
          description: MCP server id
    delete:
      operationId: deleteMcpServer
      summary: Delete an MCP server
      tags:
        - MCP servers
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: mcpId
          in: path
          required: true
          schema:
            type: string
          description: MCP server id
  /user-toolbox/{id}/mcp/{mcpId}/rotate:
    post:
      operationId: rotateMcpServerToken
      summary: Rotate MCP server token
      tags:
        - MCP servers
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                allOf:
                  - type: object
                    properties:
                      id:
                        type: string
                      user_toolbox_id:
                        type: string
                      name:
                        type: string
                      require_org_api_token:
                        type: boolean
                      token_prefix:
                        type: string
                      last_used_at:
                        type:
                          - string
                          - "null"
                        format: date-time
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                  - type: object
                    properties:
                      token:
                        type: string
                      url:
                        type: string
                        format: uri
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: Invalidates the previous token. New token shown once.
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
        - name: mcpId
          in: path
          required: true
          schema:
            type: string
          description: MCP server id
  /mcp/{token}:
    post:
      operationId: mcpJsonRpc
      summary: MCP Streamable HTTP data plane
      tags:
        - MCP data plane
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  jsonrpc:
                    type: string
                  id: {}
                  result: {}
                  error:
                    type: object
                    additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      description: JSON-RPC 2.0 over Streamable HTTP. Token is opaque (KV-resolved).
        Optional org API token second factor when require_org_api_token is set.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                jsonrpc:
                  type: string
                  enum:
                    - "2.0"
                id: {}
                method:
                  type: string
                params:
                  type: object
                  additionalProperties: true
      parameters:
        - name: token
          in: path
          required: true
          schema:
            type: string
          description: Opaque MCP token
  /restriction:
    get:
      operationId: listRestrictions
      summary: List restrictions
      tags:
        - Restrictions
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createRestriction
      summary: Create a restriction
      tags:
        - Restrictions
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - effect
                - target_type
              properties:
                effect:
                  type: string
                  enum:
                    - allow
                    - block
                target_type:
                  type: string
                  enum:
                    - connector
                    - tool
                connector_slug:
                  type: string
                tool_name:
                  type: string
                role_ids:
                  type: array
                  items:
                    type: string
                user_ids:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /restriction/{id}:
    get:
      operationId: getRestriction
      summary: Get a restriction
      tags:
        - Restrictions
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateRestriction
      summary: Update a restriction
      tags:
        - Restrictions
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteRestriction
      summary: Delete a restriction
      tags:
        - Restrictions
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /observability-destination:
    get:
      operationId: listObservabilityDestinations
      summary: List logging destinations
      tags:
        - Observability destinations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createObservabilityDestination
      summary: Create a logging destination
      tags:
        - Observability destinations
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - provider
              properties:
                name:
                  type: string
                provider:
                  type: string
                  enum:
                    - datadog
                config:
                  type: object
                  additionalProperties: true
                is_active:
                  type: boolean
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /observability-destination/{id}:
    get:
      operationId: getObservabilityDestination
      summary: Get a logging destination
      tags:
        - Observability destinations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateObservabilityDestination
      summary: Update a logging destination
      tags:
        - Observability destinations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteObservabilityDestination
      summary: Delete a logging destination
      tags:
        - Observability destinations
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /observability-destination/{id}/test:
    post:
      operationId: testObservabilityDestination
      summary: Send a test event to a logging destination
      tags:
        - Observability destinations
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  detail:
                    type: string
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /sso-connection:
    get:
      operationId: listSsoConnections
      summary: List SSO connections
      tags:
        - SSO connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createSsoConnection
      summary: Create an SSO connection
      tags:
        - SSO connections
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - protocol
              properties:
                name:
                  type: string
                protocol:
                  type: string
                  enum:
                    - oidc
                    - saml
                domains:
                  type: array
                  items:
                    type: string
                default_role_id:
                  type:
                    - string
                    - "null"
                is_active:
                  type: boolean
                config:
                  type: object
                  additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /sso-connection/{id}:
    get:
      operationId: getSsoConnection
      summary: Get an SSO connection
      tags:
        - SSO connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateSsoConnection
      summary: Update an SSO connection
      tags:
        - SSO connections
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteSsoConnection
      summary: Delete an SSO connection
      tags:
        - SSO connections
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /scim-token:
    get:
      operationId: listScimTokens
      summary: List SCIM tokens
      tags:
        - SCIM tokens
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createScimToken
      summary: Create a SCIM token (raw token shown once)
      tags:
        - SCIM tokens
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                sso_connection_id:
                  type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /scim-token/{id}:
    delete:
      operationId: deleteScimToken
      summary: Delete a SCIM token
      tags:
        - SCIM tokens
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /scim-group:
    get:
      operationId: listScimGroups
      summary: List SCIM groups
      tags:
        - SCIM groups
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
  /group-mapping:
    get:
      operationId: listGroupMappings
      summary: List SCIM group → role mappings
      tags:
        - Group mapping
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - result
                  - next_cursor
                  - prev_cursor
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                  next_cursor:
                    type:
                      - string
                      - "null"
                  prev_cursor:
                    type:
                      - string
                      - "null"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - $ref: "#/components/parameters/LimitQuery"
        - $ref: "#/components/parameters/CursorQuery"
    post:
      operationId: createGroupMapping
      summary: Create a group → role mapping
      tags:
        - Group mapping
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - scim_group_id
                - role_ids
              properties:
                scim_group_id:
                  type: string
                role_ids:
                  type: array
                  items:
                    type: string
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
  /group-mapping/{id}:
    get:
      operationId: getGroupMapping
      summary: Get a group mapping
      tags:
        - Group mapping
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: updateGroupMapping
      summary: Update a group mapping
      tags:
        - Group mapping
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: deleteGroupMapping
      summary: Delete a group mapping
      tags:
        - Group mapping
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Success"
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/OrganizationIdHeader"
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /scim/v2/Users:
    get:
      operationId: scimListUsers
      summary: SCIM List Users
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
    post:
      operationId: scimCreateUser
      summary: SCIM Create User
      tags:
        - SCIM v2
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
  /scim/v2/Users/{id}:
    get:
      operationId: scimGetUser
      summary: SCIM Get User
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    put:
      operationId: scimReplaceUser
      summary: SCIM Replace User
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: scimPatchUser
      summary: SCIM Patch User
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: scimDeleteUser
      summary: SCIM Delete User
      tags:
        - SCIM v2
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
  /scim/v2/Groups:
    get:
      operationId: scimListGroups
      summary: SCIM List Groups
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
    post:
      operationId: scimCreateGroup
      summary: SCIM Create Group
      tags:
        - SCIM v2
      responses:
        "201":
          description: Created
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
  /scim/v2/Groups/{id}:
    get:
      operationId: scimGetGroup
      summary: SCIM Get Group
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    put:
      operationId: scimReplaceGroup
      summary: SCIM Replace Group
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    patch:
      operationId: scimPatchGroup
      summary: SCIM Patch Group
      tags:
        - SCIM v2
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
    delete:
      operationId: scimDeleteGroup
      summary: SCIM Delete Group
      tags:
        - SCIM v2
      responses:
        "204":
          description: No content
        "400":
          description: Bad request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate limited
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Resource id
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: session or API token
      description: "Session cookie `elaichi_session` or `Authorization: Bearer
        <token>` (session token or org-scoped API token `elch_{org_id}_{64
        hex}`)."
  parameters:
    OrganizationIdHeader:
      name: X-Organization-Id
      in: header
      required: false
      description: Target organization. Required for cookie/session auth on org-scoped
        routes; optional for API tokens (must match the token org if present).
      schema:
        type: string
    LimitQuery:
      name: limit
      in: query
      required: false
      description: Page size (default 50, max 200).
      schema:
        type: integer
        minimum: 1
        maximum: 200
        default: 50
    CursorQuery:
      name: cursor
      in: query
      required: false
      description: Opaque cursor from a previous list response.
      schema:
        type: string
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - message
            - code
          properties:
            message:
              type: string
            code:
              type: string
            details: {}
            feature:
              type: string
            plan:
              type: string
              enum:
                - gold
                - black
                - none
          additionalProperties: true
    ListEnvelope:
      type: object
      required:
        - result
        - next_cursor
        - prev_cursor
      properties:
        result:
          type: array
          items: {}
        next_cursor:
          type:
            - string
            - "null"
        prev_cursor:
          type:
            - string
            - "null"
    User:
      type: object
      properties:
        id:
          type: string
        email:
          type: string
          format: email
        name:
          type: string
        avatar_url:
          type:
            - string
            - "null"
        identities:
          type: array
          items:
            type: object
            properties:
              provider:
                type: string
              connected_at:
                type: string
                format: date-time
        is_active:
          type: boolean
        last_login_at:
          type:
            - string
            - "null"
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    Organization:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        slug:
          type: string
        plan:
          type: string
          enum:
            - gold
            - black
            - none
        trial_ends_at:
          type:
            - string
            - "null"
          format: date-time
        settings:
          type: object
          additionalProperties: true
        logo:
          type:
            - string
            - "null"
          format: uri
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    Role:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type:
            - string
            - "null"
        is_system:
          type: boolean
        permissions:
          type: array
          items:
            type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    Member:
      type: object
      properties:
        user_id:
          type: string
        status:
          type: string
        via:
          type: string
        joined_at:
          type: string
          format: date-time
        roles:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type: string
              is_system:
                type: boolean
        teams:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type: string
        user:
          type: object
          properties:
            id:
              type: string
            email:
              type: string
            name:
              type: string
            avatar_url:
              type:
                - string
                - "null"
    Team:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type:
            - string
            - "null"
        member_user_ids:
          type: array
          items:
            type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    Success:
      type: object
      required:
        - success
      properties:
        success:
          type: boolean
