{ "openapi": "3.0.3", "info": { "title": "Intertrace API", "version": "0.1.0", "description": "Public and authenticated API surface for Intertrace telemetry, gateway enrollment, runtime tool decisions, MCP inventory, workload identity, and security exports. API-key routes use Authorization: Bearer with an Intertrace API key (prefix bst_ or itr_); dashboard routes use the session cookie. Runtime decision and session routes under /v1/runtime/* are served by the Go gateway (gateway.intertrace.ai), not the Next.js app origin." }, "servers": [ { "url": "/", "description": "Same origin as the Next.js app" } ], "paths": { "/api/gateway/verify-key": { "get": { "summary": "Verify a gateway API key and return its org binding", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Key valid \u2014 returns org_id and key metadata" }, "401": { "description": "Invalid or missing key" } } } }, "/api/gateway/event": { "post": { "summary": "Ingest a gateway security event (HMAC or internal secret)", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Event accepted" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } } }, "/api/gateway/ingest-credentials": { "get": { "summary": "Resolve hosted gateway ingest credentials", "description": "First-party hosted gateways use the internal shared secret to fetch or create per-org ingest signing material. Clients must not call this route directly.", "parameters": [ { "name": "orgId", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" }, "description": "Organization UUID that owns the ingest credentials" }, { "name": "environment", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Gateway environment for newly-created hosted credentials; defaults to production" }, { "name": "x-intertrace-internal", "in": "header", "required": true, "schema": { "type": "string" }, "description": "First-party gateway shared secret" } ], "responses": { "200": { "description": "Hosted gateway ingest credentials", "content": { "application/json": { "schema": { "type": "object", "required": [ "org_id", "key_id", "secret", "created" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "key_id": { "type": "string" }, "secret": { "type": "string", "description": "Plaintext ingest signing secret returned only to the first-party gateway." }, "created": { "type": "boolean", "description": "True when the route minted hosted credentials for the org." } } } } } }, "400": { "description": "orgId must be a UUID" }, "401": { "description": "Unauthorized" }, "503": { "description": "Internal secret not configured" }, "500": { "description": "Failed to resolve ingest credentials" } } } }, "/api/runtime/mcp-servers": { "get": { "summary": "List MCP servers for the authenticated org (optional name filter)", "security": [ { "bearerAuth": [] }, { "cookieAuth": [] } ], "parameters": [ { "name": "name", "in": "query", "schema": { "type": "string" }, "description": "Optional MCP server name filter" }, { "name": "org_id", "in": "query", "schema": { "type": "string", "format": "uuid" }, "description": "Org scope (required for gateway/internal callers)" } ], "responses": { "200": { "description": "MCP server inventory including trust_tier" }, "401": { "description": "Unauthorized" } } }, "patch": { "summary": "Update MCP server trust tier or metadata", "security": [ { "cookieAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "trust_tier": { "type": "string", "enum": [ "trusted", "restricted", "untrusted" ] }, "blocked_tools": { "type": "array", "items": { "type": "string" }, "description": "When trust_tier is restricted, tool names that must be blocked" } } } } } }, "responses": { "200": { "description": "Updated" }, "401": { "description": "Unauthorized" }, "404": { "description": "Not found" } } } }, "/api/v1/telemetry/traces": { "post": { "summary": "Ingest a trace", "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "Idempotency-Key", "in": "header", "schema": { "type": "string" }, "description": "Optional idempotency token for safe retries" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TelemetryTraceBody" } } } }, "responses": { "200": { "description": "Idempotent replay \u2014 trace already existed" }, "201": { "description": "Created" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } }, "get": { "summary": "List recent traces (session cookie)", "responses": { "200": { "description": "OK" }, "401": { "description": "Unauthorized" } } } }, "/api/v1/telemetry/traces/{id}": { "get": { "summary": "Trace detail with spans (session cookie)", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK" }, "404": { "description": "Not found" } } } }, "/api/v1/telemetry/test-connection": { "post": { "summary": "Verify API key", "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "ok: true" }, "401": { "description": "Invalid key" } } } }, "/api/cron/baseline-rollup": { "post": { "summary": "Daily baseline rollup (CRON_SECRET)", "parameters": [ { "name": "Authorization", "in": "header", "schema": { "type": "string" }, "description": "Bearer CRON_SECRET" } ], "responses": { "200": { "description": "OK" }, "401": { "description": "Unauthorized" } } } }, "/api/gateway/keys": { "get": { "summary": "List org-scoped gateway ingest keys", "description": "Returns ingest key metadata for the signed-in user's organization. Revoked keys are included so admins can audit key history.", "security": [ { "cookieAuth": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "keys": { "type": "array", "items": { "$ref": "#/components/schemas/GatewayIngestKey" } } } } } } }, "401": { "description": "Unauthorized" }, "500": { "description": "Failed to list ingest keys" } } }, "post": { "summary": "Mint an org-scoped gateway ingest key", "description": "Creates a dashboard-managed ingest signing key. The secret is returned once and must be copied into the gateway secret manager.", "security": [ { "cookieAuth": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayIngestKeyCreate" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayIngestKeyCreateResponse" } } } }, "400": { "description": "Invalid ingest key payload" }, "401": { "description": "Unauthorized" }, "500": { "description": "Failed to create ingest key" } } } }, "/api/gateway/keys/{id}": { "delete": { "summary": "Revoke a gateway ingest key", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Revoked", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "type": "boolean" }, "revoked": { "type": "string", "format": "uuid" } } } } } }, "401": { "description": "Unauthorized" }, "404": { "description": "Key not found or already revoked" }, "500": { "description": "Failed to revoke ingest key" } } } }, "/api/gateway/instances": { "get": { "summary": "List gateway instances", "description": "Returns gateway instances with associated cluster, active config version, and latest heartbeat metadata.", "security": [ { "cookieAuth": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "properties": { "instances": { "type": "array", "items": { "$ref": "#/components/schemas/GatewayInstance" } } } } } } }, "401": { "description": "Unauthorized" }, "500": { "description": "Failed to load gateway instances" } } }, "post": { "summary": "Register a gateway instance", "description": "Creates or reuses a gateway cluster, registers an instance, creates a config version, and returns a one-time enrollment token.", "security": [ { "cookieAuth": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayInstanceCreate" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GatewayInstanceCreateResponse" } } } }, "400": { "description": "Invalid gateway instance payload" }, "401": { "description": "Unauthorized" }, "500": { "description": "Failed to create gateway instance" } } } }, "/api/gateway/federation/token": { "post": { "summary": "Exchange workload identity for an ingest key", "description": "Issues a short-lived gateway ingest signing key from a configured OIDC or mTLS federation trust. This route does not require a dashboard session.", "parameters": [ { "name": "x-client-cert-fingerprint", "in": "header", "schema": { "type": "string" }, "description": "mTLS client certificate SHA-256 fingerprint when using certificate federation" } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FederationTokenRequest" } } } }, "responses": { "201": { "description": "Short-lived ingest key issued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FederationTokenResponse" } } } }, "400": { "description": "Invalid request" }, "401": { "description": "Untrusted identity" }, "429": { "description": "Rate limit exceeded" }, "500": { "description": "Federation exchange failed" } } } }, "/api/exports/agent-run/{runId}": { "get": { "summary": "Export an agent run", "description": "Returns a SIEM-friendly JSON export with the agent-run rollup and gateway-event hop summaries for the signed-in user's organization.", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "runId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentRunExport" } } } }, "400": { "description": "runId required" }, "401": { "description": "Unauthorized" }, "500": { "description": "Export failed" } } } }, "/v1/runtime/tool_calls/decision": { "post": { "summary": "Request a runtime tool-call allow/block/review decision", "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Decision (allow, block, or review)" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } }, "tags": [ "Runtime Gateway" ], "description": "Canonical path uses underscores (tool_calls). Hosted on the Go gateway." } }, "/v1/actions/authorize": { "post": { "summary": "Authorize an agent action before execution (Gateway v2)", "description": "Canonical pre-execution authorization. Hosted on the Go gateway. Returns ALLOW / BLOCK / REQUIRE_APPROVAL (and optional short-lived execution_permit).", "tags": [ "Runtime Gateway" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true, "required": [ "schema_version", "tenant_id", "agent", "action" ], "properties": { "schema_version": { "type": "string", "example": "intertrace.action.v1" }, "tenant_id": { "type": "string" }, "trace_id": { "type": "string" }, "session_id": { "type": "string" }, "agent": { "type": "object", "additionalProperties": true }, "action": { "type": "object", "additionalProperties": true } } } } } }, "responses": { "200": { "description": "Authorization decision" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } } }, "/v1/runtime/events/batch": { "post": { "summary": "Batch-ingest runtime telemetry events via the Go gateway", "description": "Public gateway path. Dashboard persistence uses internal POST /api/runtime/ingest.", "tags": [ "Runtime Gateway" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Accepted" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } } }, "/v1/runtime/sessions/start": { "post": { "summary": "Start a runtime protection session", "tags": [ "Runtime Gateway" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Session started" }, "401": { "description": "Unauthorized" } } } }, "/v1/runtime/sessions/{id}/complete": { "post": { "summary": "Complete a runtime protection session", "tags": [ "Runtime Gateway" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Session completed" }, "401": { "description": "Unauthorized" } } } }, "/v1/runtime/tool_calls/{id}/outcome": { "post": { "summary": "Report the outcome of a previously decided tool call", "tags": [ "Runtime Gateway" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Outcome recorded" }, "401": { "description": "Unauthorized" } } } }, "/v1/runtime/health": { "get": { "summary": "Gateway runtime health check", "tags": [ "Runtime Gateway" ], "responses": { "200": { "description": "OK" } } } }, "/api/health": { "get": { "summary": "Dashboard health check", "tags": [ "Platform" ], "responses": { "200": { "description": "OK" } } } }, "/api/integration-tool-calls": { "post": { "summary": "Ingest an integration tool-call event", "tags": [ "Telemetry" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Accepted" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } } }, "/api/v1/agent/tool-intent": { "post": { "summary": "Ingest an agent tool-intent signal", "tags": [ "Telemetry" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Accepted" }, "401": { "description": "Unauthorized" } } } }, "/api/v1/agent/event": { "post": { "summary": "Ingest an agent lifecycle event", "tags": [ "Telemetry" ], "security": [ { "bearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Accepted" }, "401": { "description": "Unauthorized" } } } }, "/api/assessments/start": { "post": { "summary": "Start a probe assessment", "tags": [ "Security" ], "security": [ { "cookieAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Queued" }, "401": { "description": "Unauthorized" } } } }, "/api/assessments": { "get": { "summary": "List assessments for the signed-in org", "tags": [ "Security" ], "security": [ { "cookieAuth": [] } ], "responses": { "200": { "description": "OK" }, "401": { "description": "Unauthorized" } } } }, "/api/reports/generate": { "post": { "summary": "Generate a security report export", "tags": [ "Security" ], "security": [ { "cookieAuth": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Generated" }, "401": { "description": "Unauthorized" } } } }, "/api/runtime/verify-key": { "post": { "summary": "Verify a runtime API key", "tags": [ "Runtime" ], "security": [ { "bearerAuth": [] } ], "responses": { "200": { "description": "Key valid" }, "401": { "description": "Invalid key" } } } }, "/api/findings/{id}/history": { "get": { "summary": "List structured status history for a finding", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Status timeline rows for the finding" }, "401": { "description": "Unauthorized" }, "404": { "description": "Finding not found" } } } }, "/api/findings/{id}/evidence": { "get": { "summary": "List structured evidence attached to a finding", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Evidence rows for the finding" }, "401": { "description": "Unauthorized" }, "404": { "description": "Finding not found" } } }, "post": { "summary": "Attach analyst evidence to a finding", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "evidence_type" ], "properties": { "evidence_type": { "type": "string", "enum": [ "prompt", "response", "tool_call", "policy_rule", "trace", "gateway_event", "screenshot", "log", "other" ] }, "evidence_uri": { "type": "string", "format": "uri", "nullable": true }, "content_hash": { "type": "string", "nullable": true }, "label": { "type": "string", "nullable": true }, "content_preview": { "type": "string", "nullable": true }, "metadata": { "type": "object", "additionalProperties": true } } } } } }, "responses": { "201": { "description": "Evidence stored" }, "401": { "description": "Unauthorized" }, "404": { "description": "Finding not found" }, "422": { "description": "Validation error" } } } }, "/api/assets/discovery-runs": { "get": { "summary": "List recent discovery runs for the authenticated org", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 20 } }, { "name": "cursor", "in": "query", "description": "ISO timestamp cursor (created_at of last item)", "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "Discovery runs plus enterprise discovery status" }, "401": { "description": "Unauthorized" } } } }, "/api/findings/{id}/remediation": { "get": { "summary": "List remediation plans for a finding", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Remediation rows" }, "401": { "description": "Unauthorized" }, "404": { "description": "Not found" } } }, "post": { "summary": "Create a remediation plan for a finding", "security": [ { "cookieAuth": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "planned", "in_progress", "blocked", "verified", "accepted_risk", "cancelled" ] }, "plan_summary": { "type": "string" }, "owner_email": { "type": "string", "format": "email" }, "work_item_id": { "type": "string", "format": "uuid" } } } } } }, "responses": { "201": { "description": "Created" }, "401": { "description": "Unauthorized" }, "422": { "description": "Validation error" } } } }, "/api/remediation/work-items": { "get": { "summary": "List remediation work items for the org", "security": [ { "cookieAuth": [] } ], "responses": { "200": { "description": "Work items" }, "401": { "description": "Unauthorized" } } }, "post": { "summary": "Create a remediation work item", "security": [ { "cookieAuth": [] } ], "responses": { "201": { "description": "Created" }, "401": { "description": "Unauthorized" } } } }, "/api/gateway/runtime-config": { "get": { "summary": "Org gateway runtime config (session or internal secret)", "description": "Internal callers with X-Intertrace-Internal receive mcpProxyPolicy for the MCP wire proxy plus vault credentials.", "parameters": [ { "name": "orgId", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "assetId", "in": "query", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Runtime config including mcpRegistry and mcpProxyPolicy" }, "401": { "description": "Unauthorized" } } } }, "/api/scim/v2/Users": { "get": { "summary": "SCIM Users (not offered \u2014 use WorkOS Directory Sync)", "responses": { "410": { "description": "Gone \u2014 configure SCIM via WorkOS" } } }, "post": { "summary": "SCIM Users create (not offered)", "responses": { "410": { "description": "Gone" } } } }, "/api/events/ingest": { "post": { "summary": "Canonical SecurityEventEnvelope ingest (internal)", "description": "Authenticated with x-intertrace-internal. Applies org retention and data residency controls when configured.", "responses": { "200": { "description": "Accepted" }, "400": { "description": "Invalid envelope or DLQ" }, "401": { "description": "Unauthorized" }, "403": { "description": "Data residency violation" } } } }, "/api/policy/simulate": { "post": { "summary": "Replay policy simulation on historical-like OPA inputs", "security": [{ "cookieAuth": [] }], "responses": { "200": { "description": "Simulation result with recommended_policy_changes" }, "401": { "description": "Unauthorized" } } } }, "/api/posture/evaluate": { "get": { "summary": "Evaluate posture checks for org assets", "security": [{ "cookieAuth": [] }], "responses": { "200": { "description": "Posture evaluation summary" }, "401": { "description": "Unauthorized" } } }, "post": { "summary": "Run posture evaluation and upsert findings", "security": [{ "cookieAuth": [] }], "responses": { "200": { "description": "Evaluation complete" }, "401": { "description": "Unauthorized" } } } }, "/api/otel/ingest": { "post": { "summary": "OTEL GenAI span ingest stub", "responses": { "200": { "description": "Accepted" }, "401": { "description": "Unauthorized" } } } }, "/api/discovery/coverage": { "get": { "summary": "Connector fidelity and coverage report", "security": [{ "cookieAuth": [] }], "responses": { "200": { "description": "Coverage report" }, "401": { "description": "Unauthorized" } } } }, "/api/incidents/correlate": { "post": { "summary": "Multi-event incident correlator", "security": [{ "cookieAuth": [] }], "responses": { "200": { "description": "Correlation candidates" }, "401": { "description": "Unauthorized" } } } } }, "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "bst_\u2026 or itr_\u2026 (Intertrace API key)" }, "cookieAuth": { "type": "apiKey", "in": "cookie", "name": "Supabase session" } }, "schemas": { "TelemetryTraceBody": { "type": "object", "required": [ "trace", "spans" ], "properties": { "trace": { "type": "object", "properties": { "name": { "type": "string" }, "metadata": { "type": "object", "additionalProperties": true }, "asset_id": { "type": "string", "format": "uuid" }, "intent": { "type": "object", "additionalProperties": true } } }, "spans": { "type": "array", "items": { "type": "object", "required": [ "name", "kind", "start_time", "end_time" ], "properties": { "name": { "type": "string" }, "kind": { "type": "string", "enum": [ "llm", "tool", "chain", "retrieval" ] }, "start_time": { "type": "string", "format": "date-time" }, "end_time": { "type": "string", "format": "date-time" }, "attributes": { "type": "object", "additionalProperties": true }, "parent_span_id": { "type": "string", "format": "uuid", "nullable": true } } } }, "policy": { "type": "object", "additionalProperties": true } } }, "GatewayIngestKey": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string", "format": "uuid" }, "key_id": { "type": "string" }, "label": { "type": "string", "nullable": true }, "environment": { "type": "string", "nullable": true }, "scopes": { "type": "array", "items": { "type": "string", "enum": [ "ingest", "config:read", "admin" ] } }, "instance_id": { "type": "string", "format": "uuid", "nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "revoked_at": { "type": "string", "format": "date-time", "nullable": true }, "last_used_at": { "type": "string", "format": "date-time", "nullable": true } } }, "GatewayIngestKeyCreate": { "type": "object", "properties": { "label": { "type": "string", "maxLength": 200, "nullable": true }, "environment": { "type": "string", "maxLength": 64, "nullable": true }, "scopes": { "type": "array", "items": { "type": "string", "enum": [ "ingest", "config:read", "admin" ] }, "default": [ "ingest" ] }, "instance_id": { "type": "string", "format": "uuid", "nullable": true }, "expires_in_days": { "type": "integer", "minimum": 1, "maximum": 3650, "nullable": true } } }, "GatewayIngestKeyCreateResponse": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "key_id": { "type": "string" }, "secret": { "type": "string", "description": "Returned once. Store it in the gateway secret manager." }, "scopes": { "type": "array", "items": { "type": "string" } }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "env": { "type": "object", "properties": { "INTERTRACE_GATEWAY_KEY_ID": { "type": "string" }, "INTERTRACE_GATEWAY_SIGNING_SECRET": { "type": "string" } } }, "message": { "type": "string" } } }, "GatewayInstance": { "type": "object", "additionalProperties": true, "properties": { "id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string", "format": "uuid" }, "cluster_id": { "type": "string", "format": "uuid" }, "display_name": { "type": "string" }, "gateway_type": { "type": "string", "example": "go" }, "status": { "type": "string" }, "region": { "type": "string", "nullable": true }, "base_url": { "type": "string", "format": "uri", "nullable": true }, "version": { "type": "string", "nullable": true }, "capabilities": { "type": "object", "additionalProperties": true, "nullable": true }, "last_seen_at": { "type": "string", "format": "date-time", "nullable": true }, "cluster": { "type": "object", "additionalProperties": true, "nullable": true }, "config_version": { "type": "object", "additionalProperties": true, "nullable": true }, "latest_heartbeat": { "type": "object", "additionalProperties": true, "nullable": true } } }, "GatewayInstanceCreate": { "type": "object", "properties": { "display_name": { "type": "string", "minLength": 1, "maxLength": 200, "default": "Production gateway" }, "environment": { "type": "string", "minLength": 1, "maxLength": 64, "default": "production" }, "base_url": { "type": "string", "format": "uri", "nullable": true }, "region": { "type": "string", "maxLength": 120, "nullable": true }, "gateway_type": { "type": "string", "maxLength": 64, "default": "go" }, "capabilities": { "type": "object", "additionalProperties": true, "nullable": true } } }, "GatewayInstanceCreateResponse": { "type": "object", "properties": { "ok": { "type": "boolean" }, "gateway_cluster": { "type": "object", "additionalProperties": true }, "gateway_instance": { "type": "object", "additionalProperties": true }, "gateway_config_version": { "type": "object", "additionalProperties": true }, "enrollment": { "type": "object", "properties": { "token": { "type": "string", "description": "One-time enrollment token returned once." }, "expires_at": { "type": "string", "format": "date-time" }, "exchange_url": { "type": "string" }, "message": { "type": "string" } } }, "env": { "type": "object", "properties": { "INTERTRACE_GATEWAY_CLUSTER_ID": { "type": "string" }, "INTERTRACE_GATEWAY_INSTANCE_ID": { "type": "string" }, "INTERTRACE_GATEWAY_CONFIG_VERSION_ID": { "type": "string" }, "INTERTRACE_GATEWAY_SCHEMA_VERSION": { "type": "string" }, "INTERTRACE_GATEWAY_ENROLLMENT_TOKEN": { "type": "string" } } } } }, "FederationTokenRequest": { "type": "object", "properties": { "token": { "type": "string", "description": "OIDC JWT from a configured trusted issuer." }, "org_id": { "type": "string", "format": "uuid", "nullable": true }, "environment": { "type": "string", "maxLength": 64, "nullable": true } } }, "FederationTokenResponse": { "type": "object", "properties": { "ok": { "type": "boolean" }, "org_id": { "type": "string", "format": "uuid" }, "key_id": { "type": "string" }, "ingest_secret": { "type": "string", "description": "Short-lived secret returned once." }, "scopes": { "type": "array", "items": { "type": "string" } }, "expires_at": { "type": "string", "format": "date-time" }, "env": { "type": "object", "properties": { "INTERTRACE_GATEWAY_KEY_ID": { "type": "string" }, "INTERTRACE_GATEWAY_SIGNING_SECRET": { "type": "string" } } }, "message": { "type": "string" } } }, "AgentRunExport": { "type": "object", "properties": { "schema": { "type": "string", "example": "intertrace.agent_run_export.v1" }, "exported_at": { "type": "string", "format": "date-time" }, "org_id": { "type": "string", "format": "uuid" }, "run_id": { "type": "string" }, "rollup": { "type": "object", "additionalProperties": true, "nullable": true }, "hops": { "type": "array", "items": { "$ref": "#/components/schemas/AgentRunHop" } }, "hop_count": { "type": "integer" } } }, "AgentRunHop": { "type": "object", "properties": { "event_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "inbound_verdict": { "type": "string", "nullable": true }, "outbound_verdict": { "type": "string", "nullable": true }, "model": { "type": "string", "nullable": true }, "asset_id": { "type": "string", "format": "uuid", "nullable": true }, "hop_index": { "type": "integer", "nullable": true }, "tooling_summary": { "type": "object", "additionalProperties": true, "nullable": true }, "rail_timings_ms": { "type": "object", "additionalProperties": { "type": "number" }, "nullable": true }, "latency_gateway_ms": { "type": "number", "nullable": true }, "classifier_used": { "type": "string", "nullable": true } } } } } }