{"openapi":"3.1.0","jsonSchemaDialect":"https://json-schema.org/draft/2020-12/schema","info":{"title":"abtests.dev vendor control plane","version":"0.3.0","description":"Tenant-isolated vendor implementation workflows. No SaaS procurement or outreach. Statistical workbench is a separately deployed service."},"servers":[{"url":"https://dev.abtests.dev"}],"security":[{"BearerAuth":[]}],"paths":{"/api/v1/health":{"get":{"operationId":"health","summary":"Worker liveness; does not test storage connectivity","tags":["health"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"},"service":{"type":"string"}},"required":["ok","service"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/config":{"get":{"operationId":"config","summary":"Public Clerk configuration, release and runtime policy","tags":["config"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/version":{"get":{"operationId":"version","summary":"Release identity and declared persistence environment","tags":["version"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/releases/current":{"get":{"operationId":"currentRelease","summary":"Alias of release identity","tags":["releases"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/capabilities":{"get":{"operationId":"capabilities","summary":"Workflow and transport discovery","tags":["capabilities"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/openapi.json":{"get":{"operationId":"openapi","summary":"This OpenAPI document","tags":["openapi.json"],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/me":{"get":{"operationId":"identity","summary":"Read verified account and scopes","tags":["me"],"x-required-auth":"Any verified bearer","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"account":{"type":"object","properties":{"id":{"type":"string"},"login":{"type":"string"}},"required":["id","login"]},"auth":{"type":"object","properties":{"kind":{"enum":["session","device","runtime"]},"scopes":{"type":"array","items":{"type":"string"}}},"required":["kind","scopes"]}},"required":["account","auth"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/vendors":{"get":{"operationId":"vendorsList","summary":"Search tenant inventory with stable ID cursor","tags":["vendors"],"x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"query","in":"query","schema":{"type":"string","maxLength":120}},{"name":"status","in":"query","schema":{"type":"string","maxLength":40}},{"name":"category","in":"query","schema":{"type":"string","maxLength":80}},{"name":"cursor","in":"query","schema":{"type":"string","maxLength":100}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"vendors":{"type":"array","items":{"$ref":"#/components/schemas/Vendor"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["vendors","next_cursor"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"operationId":"vendorsCreate","summary":"Register a vendor definition; does not create a SaaS account","tags":["vendors"],"description":"Not idempotent. If the response is lost, search existing inventory before retrying. Maximum 1000 vendors per tenant.","x-required-auth":"manage: Clerk session or approved device token","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VendorCreate"}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/Vendor"}},"required":["vendor"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/vendors/seed":{"post":{"operationId":"vendorsSeed","summary":"Explicitly add the three starter GTM definitions","tags":["vendors"],"description":"Existing seeded definitions are retained; no sessions or outcomes are fabricated.","x-required-auth":"manage: Clerk session or approved device token","responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"vendors":{"type":"array","items":{"$ref":"#/components/schemas/Vendor"}}},"required":["vendors"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/vendors/{id}":{"get":{"operationId":"vendorsGet","summary":"Read vendor and recent related records","tags":["vendors"],"x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/Vendor"},"runs":{"type":"array","items":{"$ref":"#/components/schemas/Run"}},"handoffs":{"type":"array","items":{"$ref":"#/components/schemas/Handoff"}}},"required":["vendor","runs","handoffs"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"patch":{"operationId":"vendorsUpdate","summary":"Update metadata using compare-and-swap revision","tags":["vendors"],"description":"Use expected_revision from the latest read. Credential references only; no raw secrets. Session state is operator-reported metadata.","x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VendorUpdate"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/Vendor"}},"required":["vendor"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/accounts":{"get":{"operationId":"accountsList","summary":"Read vendor credential references and session metadata","tags":["accounts"],"x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"query","in":"query","schema":{"type":"string","maxLength":120}},{"name":"status","in":"query","schema":{"type":"string","maxLength":40}},{"name":"category","in":"query","schema":{"type":"string","maxLength":80}},{"name":"cursor","in":"query","schema":{"type":"string","maxLength":100}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":100}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"accounts":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"vendor_id":{"type":"string"},"credential_ref":{"anyOf":[{"type":"string"},{"type":"null"}]},"session_state":{"type":"string"}},"required":["id","vendor_id","credential_ref","session_state"]}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["accounts","next_cursor"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runs":{"get":{"operationId":"runsList","summary":"Read latest 200 runs","tags":["runs"],"x-required-auth":"manage: Clerk session or approved device token","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"runs":{"type":"array","items":{"$ref":"#/components/schemas/Run"}},"has_more":{"type":"boolean"}},"required":["runs","has_more"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"operationId":"runsStart","summary":"Queue a bounded task with stable retry identity","tags":["runs"],"description":"Same idempotency_key + vendor + intent returns the same run. Model and effort fixed. No purchases, outreach or arbitrary computer commands. Login/implement can end in human handoff.","x-required-auth":"manage: Clerk session or approved device token","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunCreate"}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"run":{"$ref":"#/components/schemas/Run"},"duplicate":{"type":"boolean"}},"required":["run","duplicate"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runs/{id}":{"get":{"operationId":"runsGet","summary":"Read run and private event evidence","tags":["runs"],"x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"run":{"$ref":"#/components/schemas/Run"},"events":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["run","events"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runs/{id}/cancel":{"post":{"operationId":"runsCancel","summary":"Cancel run and invalidate active lease","tags":["runs"],"description":"Terminal states return run_terminal; a repeat is not automatically successful. Cannot undo observations already made.","x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"cancelled":{"type":"boolean"}},"required":["cancelled"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/handoffs":{"get":{"operationId":"handoffsList","summary":"List tenant human handoffs","tags":["handoffs"],"x-required-auth":"manage: Clerk session or approved device token","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"handoffs":{"type":"array","items":{"$ref":"#/components/schemas/Handoff"}}},"required":["handoffs"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/handoffs/{id}":{"patch":{"operationId":"handoffsResolve","summary":"Record resolution without restarting execution","tags":["handoffs"],"x-required-auth":"manage: Clerk session or approved device token","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HandoffUpdate"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"handoff":{"$ref":"#/components/schemas/Handoff"}},"required":["handoff"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/device/start":{"post":{"operationId":"deviceStart","summary":"Start verifier-bound device approval","tags":["device"],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"challenge":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"required":["challenge"],"additionalProperties":false}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"device_code":{"type":"string","pattern":"^[a-f0-9]{64}$"},"user_code":{"type":"string"},"verification_uri_complete":{"type":"string"},"expires_in":{"type":"integer"},"interval":{"type":"integer"}},"required":["device_code","user_code","verification_uri_complete","expires_in","interval"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/device/poll":{"post":{"operationId":"devicePoll","summary":"Poll and consume approval once","tags":["device"],"description":"Never log device_code, verifier or returned token. Pending returns202. Approved device bearer expires after30days.","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"device_code":{"type":"string","pattern":"^[a-f0-9]{64}$"},"verifier":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"required":["device_code","verifier"],"additionalProperties":false}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"token":{"type":"string"},"account":{"type":"object","properties":{"id":{"type":"string"},"login":{"type":"string"}},"required":["id","login"]}},"required":["status","token","account"]}}}},"202":{"description":"Approval pending","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"const":"pending"}},"required":["status"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/device/approve":{"post":{"operationId":"deviceApprove","summary":"Approve a device using a verified browser session","tags":["device"],"x-required-auth":"Clerk session only; matching Origin required","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"user_code":{"type":"string","pattern":"^[A-Z]{8}$"}},"required":["user_code"],"additionalProperties":false}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"approved":{"type":"boolean"}},"required":["approved"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/device/logout":{"post":{"operationId":"deviceLogout","summary":"Revoke the current device or runtime token","tags":["device"],"x-required-auth":"Approved device or runtime bearer only","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"}},"required":["revoked"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runtime-tokens":{"get":{"operationId":"tokensList","summary":"List device/runtime token metadata, never secrets","tags":["runtime-tokens"],"x-required-auth":"Clerk session only","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"tokens":{"type":"array","items":{"type":"object","additionalProperties":true}}},"required":["tokens"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"operationId":"runtimeTokenCreate","summary":"Issue a narrow runtime token once","tags":["runtime-tokens"],"x-required-auth":"Clerk session only; matching Origin required","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuntimeTokenCreate"}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string"},"id":{"type":"string"},"expires_at":{"type":"string"}},"required":["token","id","expires_at"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runtime-tokens/{id}":{"delete":{"operationId":"tokenRevoke","summary":"Revoke a device or runtime token","tags":["runtime-tokens"],"x-required-auth":"Clerk session only; matching Origin required","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"}},"required":["revoked"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runtime/claim":{"post":{"operationId":"runtimeClaim","summary":"Lease a queued run for bounded execution","tags":["runtime"],"description":"Leased payload includes private credential reference and one-time lease_token. Never expose these to models or logs.","x-required-auth":"runtime scope","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuntimeClaim"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"run":{"anyOf":[{"type":"object","additionalProperties":true},{"type":"null"}]}},"required":["run"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runtime/runs/{id}/heartbeat":{"post":{"operationId":"runtimeHeartbeat","summary":"Renew owned lease for120seconds","tags":["runtime"],"x-required-auth":"runtime scope + active owned lease","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuntimeHeartbeat"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"lease_expires_at":{"type":"string","format":"date-time"}},"required":["lease_expires_at"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/runtime/runs/{id}/events":{"post":{"operationId":"runtimeEvent","summary":"Append idempotent event or terminal report","tags":["runtime"],"description":"Stable external_id retries require identical payload. At most100events and10screenshots/run. Tenant, token and lease checked transactionally.","x-required-auth":"runtime scope + active owned lease","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuntimeEvent"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"event":{"$ref":"#/components/schemas/Event"},"duplicate":{"type":"boolean"}},"required":["event","duplicate"]}}}},"400":{"description":"Invalid request. Raw secrets and unsupported fields are rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Bearer credential missing, expired or revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Scope or origin does not permit this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"No record in the authenticated tenant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, idempotency, lease, status or capacity conflict; inspect state before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"Request body exceeds 262144 bytes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limited; wait before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Persistence binding unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}},"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","description":"Verified Clerk JWT, approved abdev_ device token, or narrowly scoped abrt_ runtime token. Each route enforces its own scope."}},"schemas":{"Error":{"type":"object","properties":{"error":{"type":"string"}},"required":["error"]},"VendorCreate":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":120},"homepage_url":{"type":"string","maxLength":1000,"format":"uri"},"login_url":{"type":"string","maxLength":1000,"format":"uri"},"category":{"default":"GTM","type":"string","minLength":1,"maxLength":80},"allowed_domains":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253,"pattern":"^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z][a-z0-9-]{1,62}$"}}},"required":["name","homepage_url","login_url"],"additionalProperties":false},"VendorUpdate":{"type":"object","properties":{"expected_revision":{"type":"integer","minimum":1,"maximum":9007199254740991},"status":{"type":"string","enum":["planned","onboarding","ready","blocked","paused"]},"session_state":{"type":"string","enum":["unknown","signed_out","active","expired","needs_human"]},"credential_ref":{"anyOf":[{"type":"string","maxLength":200,"pattern":"^(?:vault|executor|modal|profile):\\/\\/[a-zA-Z0-9][a-zA-Z0-9/_-]*$"},{"type":"null"}]},"notes":{"type":"string","maxLength":4000},"implementation_checks":{"maxItems":30,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"label":{"type":"string","minLength":1,"maxLength":160},"status":{"type":"string","enum":["todo","done","blocked"]}},"required":["id","label","status"],"additionalProperties":false}}},"required":["expected_revision"],"additionalProperties":false},"RunCreate":{"type":"object","properties":{"vendor_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"intent":{"type":"string","enum":["inspect","login","implement"]},"idempotency_key":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"}},"required":["vendor_id","intent","idempotency_key"],"additionalProperties":false},"RuntimeClaim":{"type":"object","properties":{"worker_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"capabilities":{"minItems":1,"maxItems":1,"type":"array","items":{"type":"string","enum":["computer_use"]}}},"required":["worker_id","capabilities"],"additionalProperties":false},"RuntimeHeartbeat":{"type":"object","properties":{"lease_token":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"required":["lease_token"],"additionalProperties":false},"RuntimeEvent":{"type":"object","properties":{"lease_token":{"type":"string","pattern":"^[a-f0-9]{64}$"},"external_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"type":{"type":"string","enum":["progress","artifact","handoff","completed","failed"]},"message":{"type":"string","minLength":1,"maxLength":2000},"artifact_url":{"type":"string","maxLength":1000,"format":"uri"},"artifact_sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"artifact_path":{"type":"string","maxLength":500,"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_./-]*$"},"handoff_reason":{"type":"string","minLength":1,"maxLength":500},"image_data_url":{"type":"string","maxLength":240000,"pattern":"^data:image\\/jpeg;base64,\\/9j\\/[A-Za-z0-9+/]*={0,2}$"}},"required":["lease_token","external_id","type","message"],"additionalProperties":false},"RuntimeTokenCreate":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":100},"expires_in_days":{"default":30,"type":"integer","minimum":1,"maximum":90}},"required":["label"],"additionalProperties":false},"HandoffUpdate":{"type":"object","properties":{"status":{"type":"string","const":"resolved"},"resolution":{"type":"string","minLength":10,"maxLength":2000}},"required":["status","resolution"],"additionalProperties":false},"Vendor":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"name":{"type":"string"},"homepage_url":{"type":"string","format":"uri"},"login_url":{"type":"string","format":"uri"},"category":{"type":"string"},"allowed_domains":{"type":"array","items":{"type":"string"}},"status":{"enum":["planned","onboarding","ready","blocked","paused"]},"session_state":{"enum":["unknown","signed_out","active","expired","needs_human"]},"credential_ref":{"anyOf":[{"type":"string"},{"type":"null"}]},"notes":{"type":"string"},"implementation_checks":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"label":{"type":"string","minLength":1,"maxLength":160},"status":{"type":"string","enum":["todo","done","blocked"]}},"required":["id","label","status"],"additionalProperties":false}},"revision":{"type":"integer","minimum":1},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"}},"required":["id","name","homepage_url","login_url","category","allowed_domains","status","session_state","credential_ref","notes","implementation_checks","revision","created_at","updated_at"]},"Run":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"vendor_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"vendor_name":{"type":"string"},"intent":{"enum":["inspect","login","implement"]},"idempotency_key":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"status":{"enum":["queued","running","completed","needs_human","failed","cancelled"]},"model":{"const":"gpt-6-astra"},"reasoning_effort":{"const":"low"},"purchase_allowed":{"const":false},"created_at":{"type":"string"},"updated_at":{"type":"string"}},"required":["id","vendor_id","vendor_name","intent","idempotency_key","status","model","reasoning_effort","purchase_allowed","created_at","updated_at"]},"Event":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"run_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"external_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"type":{"enum":["progress","artifact","handoff","completed","failed"]},"message":{"type":"string"},"created_at":{"type":"string"},"image_data_url":{"type":"string","maxLength":240000,"description":"Private JPEG data URL; returned only to authenticated tenant. Omitted from ordinary MCP results."},"artifact_url":{"type":"string"},"artifact_sha256":{"type":"string"},"artifact_path":{"type":"string"},"handoff_reason":{"type":"string"}},"required":["id","run_id","external_id","type","message","created_at"]},"Handoff":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"vendor_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"run_id":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9_-]+$"},"reason":{"type":"string"},"status":{"enum":["open","resolved"]},"resolution":{"type":"string"},"created_at":{"type":"string"},"updated_at":{"type":"string"}},"required":["id","vendor_id","run_id","reason","status","created_at","updated_at"]},"Release":{"type":"object","properties":{"environment":{"type":"string"},"version":{"type":"string"},"commit":{"anyOf":[{"type":"string"},{"type":"null"}]},"release_sha":{"anyOf":[{"type":"string"},{"type":"null"}]},"deployed_at":{"anyOf":[{"type":"string"},{"type":"null"}]},"persistence_environment":{"anyOf":[{"type":"string"},{"type":"null"}]},"persistence_configured":{"type":"boolean"}},"required":["environment","version","commit","release_sha","deployed_at","persistence_environment","persistence_configured"]}}},"x-mcp":{"url":"/mcp","transport":"streamable_http","authentication":"Approved device bearer; no OAuth discovery or anonymous tools."}}